<?xml version="1.0" encoding="UTF-8"?>
<procmon><processlist><process>
<ProcessIndex>213</ProcessIndex>
<ProcessId>4272</ProcessId>
<ParentProcessId>2608</ParentProcessId>
<ParentProcessIndex>214</ParentProcessIndex>
<AuthenticationId>00000000:00021a24</AuthenticationId>
<CreateTime>130412103386814285</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>High</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>Procmon.exe</ProcessName>
<ImagePath>F:\Procmon.exe</ImagePath>
<CommandLine>&quot;F:\Procmon.exe&quot; </CommandLine>
<CompanyName>Sysinternals - www.sysinternals.com</CompanyName>
<Version>3.10</Version>
<Description>Process Monitor</Description>
<modulelist>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x350000</BaseAddress>
<Size>2547712</Size>
<Path>F:\Procmon.exe</Path>
<Version>3.10</Version>
<Company>Sysinternals - www.sysinternals.com</Company>
<Description>Process Monitor</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x719c0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\FLTLIB.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Filter Library</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103567999953</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>214</ProcessIndex>
<ProcessId>2608</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>221</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130412103373853544</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>Procmon.exe</ProcessName>
<ImagePath>F:\Procmon.exe</ImagePath>
<CommandLine>&quot;F:\Procmon.exe&quot; </CommandLine>
<CompanyName>Sysinternals - www.sysinternals.com</CompanyName>
<Version>3.10</Version>
<Description>Process Monitor</Description>
<modulelist>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x350000</BaseAddress>
<Size>2547712</Size>
<Path>F:\Procmon.exe</Path>
<Version>3.10</Version>
<Company>Sysinternals - www.sysinternals.com</Company>
<Description>Process Monitor</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x719c0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\FLTLIB.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Filter Library</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\DEVRTL.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571289172</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>215</ProcessIndex>
<ProcessId>4</ProcessId>
<ParentProcessId>0</ParentProcessId>
<ParentProcessIndex>216</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321370660133</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>System</ProcessName>
<ImagePath>System</ImagePath>
<CommandLine></CommandLine>
<CompanyName></CompanyName>
<Version></Version>
<Description></Description>
<modulelist>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x890000</BaseAddress>
<Size>679936</Size>
<Path>C:\Windows\System32\autochk.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Auto Check Utility</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x47a00000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\System32\smss.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Session Manager</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\msasn1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\System32\devobj.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\System32\wintrust.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\System32\crypt32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x760d0000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\System32\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\System32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\System32\clbcatq.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\System32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\System32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\System32\ws2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\System32\comdlg32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76980000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\System32\difxapi.dll</Path>
<Version>2.1</Version>
<Company>Microsoft Corporation</Company>
<Description>Driver Install Frameworks for API library module</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\psapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\System32\wininet.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\System32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\nsi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\System32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76f10000</BaseAddress>
<Size>172032</Size>
<Path>C:\Windows\System32\imagehlp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT Image Helper</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\System32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\System32\shell32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\System32\Wldap32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x77f50000</BaseAddress>
<Size>327680</Size>
<Path>C:\Windows\System32\apisetschema.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ApiSet Schema DLL</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x80b99000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\kdcom.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Serial Kernel Debugger</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x82e56000</BaseAddress>
<Size>4268032</Size>
<Path>C:\Windows\system32\ntkrnlpa.exe</Path>
<Version>6.1.7601.17640 (win7sp1_gdr.110622-1506)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Kernel &amp; System</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c220000</BaseAddress>
<Size>544768</Size>
<Path>C:\Windows\system32\mcupdate_GenuineIntel.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Intel Microcode Update Library</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c2b6000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\BOOTVID.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>VGA Boot Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c300000</BaseAddress>
<Size>700416</Size>
<Path>C:\Windows\system32\CI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Code Integrity Module</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c3df000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\DRIVERS\cdrom.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SCSI CD-ROM Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c409000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\drivers\fileinfo.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FileInfo Filter Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c41c000</BaseAddress>
<Size>462848</Size>
<Path>C:\Windows\system32\drivers\Wdf01000.sys</Path>
<Version>1.9.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kernel Mode Driver Framework Runtime</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c49b000</BaseAddress>
<Size>294912</Size>
<Path>C:\Windows\system32\drivers\ACPI.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ACPI Driver for NT</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c4ec000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\drivers\msisadrv.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ISA Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c51e000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\drivers\vdrvroot.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Virtual Drive Root Enumerator</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c53a000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\drivers\compbatt.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Composite Battery Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c54d000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\drivers\volmgr.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Volume Manager Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c5a8000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\drivers\pciide.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Generic PCI IDE Bus Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c5bd000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\drivers\mountmgr.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Mount Point Manager</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c5dc000</BaseAddress>
<Size>143360</Size>
<Path>C:\Windows\system32\drivers\ataport.SYS</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ATAPI Driver Extension</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c748000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\System32\Drivers\msrpc.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kernel Remote Procedure Call Provider</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c786000</BaseAddress>
<Size>380928</Size>
<Path>C:\Windows\System32\Drivers\cng.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kernel Cryptography, Next Generation</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c7f1000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\Drivers\Fs_Rec.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>File System Recognizer Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c800000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\Drivers\aswRvrt.sys</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c838000</BaseAddress>
<Size>749568</Size>
<Path>C:\Windows\system32\drivers\ndis.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NDIS 6.20 driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c92d000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\System32\Drivers\ksecpkg.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kernel Security Support Provider Interface Packages</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c962000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\drivers\hwpolicy.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Hardware Policy Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c99c000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\drivers\disk.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PnP Disk Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8c9d2000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\Drivers\aswVmm.sys</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8cb51000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\System32\drivers\fwpkclnt.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec Kernel-Mode API</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8cb8b000</BaseAddress>
<Size>258048</Size>
<Path>C:\Windows\system32\drivers\volsnap.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Volume Shadow Copy Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x8cbd2000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\System32\drivers\rdyboost.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ReadyBoost Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x9041a000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\DRIVERS\lltdio.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Link-Layer Topology Mapper I/O Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x90437000</BaseAddress>
<Size>782336</Size>
<Path>C:\Windows\System32\Drivers\aswSnx.SYS</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Virtualization Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x904ff000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\System32\Drivers\Null.SYS</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NULL Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x9050d000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\drivers\vga.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>VGA/Super VGA Video Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x9053a000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\drivers\watchdog.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Watchdog Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x9054f000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\drivers\rdpencdd.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>RDP Encoder Miniport</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x9055f000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\Drivers\Msfs.SYS</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Mailslot driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x90578000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\DRIVERS\tdx.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TDI Translation Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x9059b000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\Drivers\aswTdi.SYS</Path>
<Version>8.0.1506.399 built by: WinDDK</Version>
<Company>AVAST Software</Company>
<Description>avast! TDI Filter Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x905be000</BaseAddress>
<Size>212992</Size>
<Path>C:\Windows\system32\DRIVERS\ks.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kernel CSA Library</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92071000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\System32\Drivers\dfsc.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>DFS Namespace Client Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92097000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\System32\Drivers\aswSP.SYS</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! self protection module</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92110000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DRIVERS\intelppm.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Processor Device Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x921d9000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\DRIVERS\ndiswan.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>MS PPP Framing Driver (Strong Encryption)</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92217000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\DRIVERS\umbus.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User-Mode Bus Enumerator</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x9222d000</BaseAddress>
<Size>368640</Size>
<Path>C:\Windows\system32\drivers\afd.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Ancillary Function Driver for WinSock</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92297000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\System32\DRIVERS\netbt.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>MBT Transport driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x922d0000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\DRIVERS\pacer.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>QoS Packet Scheduler</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92300000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\DRIVERS\netbios.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NetBIOS interface driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92328000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\DRIVERS\wanarp.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>MS Remote Access and Routing ARP Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x9234c000</BaseAddress>
<Size>266240</Size>
<Path>C:\Windows\system32\DRIVERS\rdbss.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Redirected Drive Buffering SubSystem Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92397000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\DRIVERS\mssmbios.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>System Management BIOS Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x923ad000</BaseAddress>
<Size>307200</Size>
<Path>C:\Windows\system32\DRIVERS\USBPORT.SYS</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>USB 1.1 &amp; 2.0 Port Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92854000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\DRIVERS\ndisuio.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NDIS User mode I/O driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92877000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\DRIVERS\RtNdPt60.sys</Path>
<Version>6.0.0717.2009 built by: WinDDK</Version>
<Company>Realtek                                            </Company>
<Description>Realtek NDIS Protocol Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92908000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\DRIVERS\bowser.sys</Path>
<Version>6.1.7601.17565 (win7sp1_gdr.110222-1630)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Lan Manager Datagram Receiver Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92933000</BaseAddress>
<Size>143360</Size>
<Path>C:\Windows\system32\DRIVERS\mrxsmb.sys</Path>
<Version>6.1.7601.17605 (win7sp1_gdr.110426-1503)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT SMB Minirdr</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x92991000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\DRIVERS\mrxsmb20.sys</Path>
<Version>6.1.7601.17605 (win7sp1_gdr.110426-1503)</Version>
<Company>Microsoft Corporation</Company>
<Description>Longhorn SMB 2.0 Redirector</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x929b3000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\drivers\cpuz135_x32.sys</Path>
<Version>6.1.7600.16385 built by: WinDDK</Version>
<Company>CPUID</Company>
<Description>CPUID Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x93372000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\System32\drivers\dxgmms1.sys</Path>
<Version>6.1.7601.17554 (win7sp1_gdr.110202-1504)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX Graphics MMS</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x933b6000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\DRIVERS\usbehci.sys</Path>
<Version>6.1.7601.17586 (win7sp1_gdr.110324-1501)</Version>
<Company>Microsoft Corporation</Company>
<Description>EHCI eUSB Miniport Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x933e4000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\DRIVERS\raspppoe.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>RAS PPPoE mini-port/call-manager driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x97e00000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\DRIVERS\rasl2tp.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>RAS L2TP mini-port/call-manager driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x97e23000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\DRIVERS\rdpbus.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft RDP Bus Device driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x97f80000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\DRIVERS\vwifibus.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Virtual WiFi Bus Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x97f94000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\DRIVERS\parport.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Parallel Port Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x97fc4000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\DRIVERS\kbdclass.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Keyboard Class Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x97fde000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DRIVERS\AgileVpn.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>RAS Agile Vpn Miniport Call Manager</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x97ffd000</BaseAddress>
<Size>8192</Size>
<Path>C:\Windows\system32\DRIVERS\swenum.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Plug and Play Software Device Enumerator</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x9804a000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\System32\Drivers\NDProxy.SYS</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>NDIS Proxy</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x980ab000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\drivers\portcls.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Port Class (Class Driver for Port/Miniport Devices)</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x980f3000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\drivers\Dxapi.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX API Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x9810a000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\Drivers\dump_dumpata.sys</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x9811e000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\System32\Drivers\dump_dumpfve.sys</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x98146000</BaseAddress>
<Size>8192</Size>
<Path>C:\Windows\system32\DRIVERS\USBD.SYS</Path>
<Version>6.1.7601.17586 (win7sp1_gdr.110324-1501)</Version>
<Company>Microsoft Corporation</Company>
<Description>Universal Serial Bus Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x98176000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\drivers\BdaSup.SYS</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft BDA Driver Support Library</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x98184000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\DRIVERS\hidusb.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>USB Miniport Driver for Input Devices</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x981a2000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\DRIVERS\HIDPARSE.SYS</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Hid Parsing Library</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x981b4000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\drivers\luafv.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LUA File Virtualization Filter Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x981f1000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\Drivers\aswFsBlk.SYS</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! File System Access Blocking Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x99a00000</BaseAddress>
<Size>122880</Size>
<Path>C:\Windows\System32\cdd.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Canonical Display Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x99b70000</BaseAddress>
<Size>2416640</Size>
<Path>C:\Windows\System32\win32k.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Win32 Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0x99dd0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\TSDDD.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Framebuffer Display Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0xa1ac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\Drivers\secdrv.SYS</Path>
<Version>4.03.086</Version>
<Company>Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.</Company>
<Description>Macrovision SECURITY Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0xa1aeb000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\drivers\tcpipreg.sys</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TCP/IP Registry Compatibility Driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0xa1b48000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\System32\DRIVERS\srv.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0xa1b9d000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\system32\Drivers\GVTDrv.sys</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0xaa285000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\DRIVERS\asyncmac.sys</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MS Remote Access serial network driver</Description>
</module>
<module>
<Timestamp>130412103568000684</Timestamp>
<BaseAddress>0xaa296000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\Drivers\PROCMON23.SYS</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>216</ProcessIndex>
<ProcessId>0</ProcessId>
<ParentProcessId>0</ParentProcessId>
<ParentProcessIndex>216</ParentProcessIndex>
<AuthenticationId>00000000:00000000</AuthenticationId>
<CreateTime>130411321285000000</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>4294967295</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity></Integrity>
<Owner></Owner>
<ProcessName>Idle</ProcessName>
<ImagePath>Idle</ImagePath>
<CommandLine></CommandLine>
<CompanyName></CompanyName>
<Version></Version>
<Description></Description>
<modulelist>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x350000</BaseAddress>
<Size>2547712</Size>
<Path>F:\Procmon.exe</Path>
<Version>3.10</Version>
<Company>Sysinternals - www.sysinternals.com</Company>
<Description>Process Monitor</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x719c0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\FLTLIB.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Filter Library</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571285893</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>217</ProcessIndex>
<ProcessId>4088</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411322162691518</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>SearchIndexer.exe</ProcessName>
<ImagePath>C:\Windows\system32\SearchIndexer.exe</ImagePath>
<CommandLine>C:\Windows\system32\SearchIndexer.exe /Embedding</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Microsoft Windows Search Indexer</Description>
<modulelist>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x350000</BaseAddress>
<Size>434176</Size>
<Path>C:\Windows\system32\SearchIndexer.exe</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Search Indexer</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x5b330000</BaseAddress>
<Size>2142208</Size>
<Path>C:\Windows\System32\NLSLexicons0021.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Neutral Natural Language Server Data and Code</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x5b540000</BaseAddress>
<Size>1839104</Size>
<Path>C:\Windows\System32\NLSData0021.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Neutral Natural Language Server Data and Code</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x62bb0000</BaseAddress>
<Size>4898816</Size>
<Path>C:\Windows\System32\NLSData0009.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft English Natural Language Server Data and Code</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x65090000</BaseAddress>
<Size>2633728</Size>
<Path>C:\Windows\System32\NLSLexicons0009.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft English Natural Language Server Data and Code</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x67150000</BaseAddress>
<Size>565248</Size>
<Path>C:\Windows\system32\ElsLad.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ELS Language Detection</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x67440000</BaseAddress>
<Size>1257472</Size>
<Path>C:\Windows\System32\msxml3.dll</Path>
<Version>8.110.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 3.0 SP11</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x682a0000</BaseAddress>
<Size>811008</Size>
<Path>C:\Windows\System32\NaturalLanguage6.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Natural Language Development Platform 6</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x6b590000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\vss_ps.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Service proxy/stub</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x6b700000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\system32\en-us\tQuery.dll.mui</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>tquery.dll</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x6b740000</BaseAddress>
<Size>1716224</Size>
<Path>C:\Windows\system32\ESENT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Extensible Storage Engine for Microsoft(R) Windows(R)</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x6b8f0000</BaseAddress>
<Size>1560576</Size>
<Path>C:\Windows\system32\TQUERY.DLL</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>tquery.dll</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x6ba70000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\mssprxy.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Search Proxy</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x6ba80000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\Msidle.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Idle Monitor</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x6ba90000</BaseAddress>
<Size>1413120</Size>
<Path>C:\Windows\system32\MSSRCH.DLL</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>mssrch.dll</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x6d6d0000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\elscore.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Els Core Platform DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x6f7b0000</BaseAddress>
<Size>1138688</Size>
<Path>C:\Windows\system32\VSSAPI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Requestor/Writer Services API DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x706b0000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\VssTrace.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Service Tracing Library</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x740d0000</BaseAddress>
<Size>290816</Size>
<Path>C:\Windows\system32\es.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\propsys.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\psapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103568010460</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>218</ProcessIndex>
<ProcessId>600</ProcessId>
<ParentProcessId>552</ParentProcessId>
<ParentProcessIndex>230</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321452092276</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>services.exe</ProcessName>
<ImagePath>C:\Windows\system32\services.exe</ImagePath>
<CommandLine>C:\Windows\system32\services.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Services and Controller app</Description>
<modulelist>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x910000</BaseAddress>
<Size>266240</Size>
<Path>C:\Windows\system32\services.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Services and Controller app</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75350000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\UBPM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unified Background Process Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75860000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\AUTHZ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Authorization Framework</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75d50000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\SCESRV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Configuration Editor Engine</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75db0000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\scext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Service Control Manager Extension DLL for non-minwin</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286319</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>219</ProcessIndex>
<ProcessId>2268</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321736058767</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>des2svr.exe</ProcessName>
<ImagePath>C:\Program Files\GIGABYTE\EnergySaver2\des2svr.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\GIGABYTE\EnergySaver2\des2svr.exe&quot;</CommandLine>
<CompanyName></CompanyName>
<Version></Version>
<Description></Description>
<modulelist>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>65536</Size>
<Path>C:\Program Files\GIGABYTE\EnergySaver2\des2svr.exe</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>102400</Size>
<Path>C:\Program Files\GIGABYTE\EnergySaver2\ycc.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x734e0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\perfos.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows System Performance Objects DLL</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103568212642</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>220</ProcessIndex>
<ProcessId>4024</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>221</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322143503485</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>1</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>RaUI.exe</ProcessName>
<ImagePath>C:\Program Files\Ralink\Common\RaUI.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Ralink\Common\RaUI.exe&quot; -s</CommandLine>
<CompanyName>Ralink Technology, Corp.</CompanyName>
<Version>4.1.1.0</Version>
<Description>Ralink Wireless LAN Card Utility</Description>
<modulelist>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>13176832</Size>
<Path>C:\Program Files\Ralink\Common\RaUI.exe</Path>
<Version>4.1.1.0</Version>
<Company>Ralink Technology, Corp.</Company>
<Description>Ralink Wireless LAN Card Utility</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x3150000</BaseAddress>
<Size>1634304</Size>
<Path>C:\Windows\system32\RaCertMgr.dll</Path>
<Version>1, 0, 0, 9</Version>
<Company>Ralink Technology, Corp.</Company>
<Description>RaCertMg Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x4b90000</BaseAddress>
<Size>1093632</Size>
<Path>C:\Program Files\Ralink\Common\CiscoEapFast.dll</Path>
<Version>2, 2, 14, 0</Version>
<Company>Cisco Systems, Inc.</Company>
<Description>Cisco EAP-FAST Module</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x4f70000</BaseAddress>
<Size>552960</Size>
<Path>C:\Program Files\Ralink\Common\ICSDHCP.dll</Path>
<Version>1, 1, 2, 14</Version>
<Company>Ralink Technology, Inc.</Company>
<Description>ICSDHCP DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>1101824</Size>
<Path>C:\Program Files\Ralink\Common\RaWLAPI.dll</Path>
<Version>1, 1, 0, 0</Version>
<Company></Company>
<Description>RaWLAPI DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\MSIMG32.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.DLL</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x72090000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\WlanApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows WLAN AutoConfig Client Side API DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\wsock32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x72540000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wlanutil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Utility DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x72590000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\eappcfg.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eap Peer Config</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x725c0000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\eappprxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft EAPHost Peer Client DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\iphlpapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x72bf0000</BaseAddress>
<Size>1015808</Size>
<Path>C:\Windows\system32\CRYPTUI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust UI Provider</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x73010000</BaseAddress>
<Size>634880</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll</Path>
<Version>8.00.50727.4940</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x730b0000</BaseAddress>
<Size>552960</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCP80.dll</Path>
<Version>8.00.50727.4940</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C++ Runtime Library</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\RASAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.DLL</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\OLE32.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103568881845</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>221</ProcessIndex>
<ProcessId>1772</ProcessId>
<ParentProcessId>1884</ParentProcessId>
<ParentProcessIndex>249</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411321565862468</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>Explorer.EXE</ProcessName>
<ImagePath>C:\Windows\Explorer.EXE</ImagePath>
<CommandLine>C:\Windows\Explorer.EXE</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Explorer</Description>
<modulelist>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x690000</BaseAddress>
<Size>2625536</Size>
<Path>C:\Windows\Explorer.EXE</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Explorer</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x4330000</BaseAddress>
<Size>122880</Size>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\Shfusion.dll</Path>
<Version>2.0.50727.5420 (Win7SP1.050727-5400)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft COM Runtime Fusion Assembly Viewer</Description>
</module>
<module>
<Timestamp>130412103635778901</Timestamp>
<BaseAddress>0x6190000</BaseAddress>
<Size>372736</Size>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Problem Reporting</Description>
</module>
<module>
<Timestamp>130412103633400404</Timestamp>
<BaseAddress>0x9a80000</BaseAddress>
<Size>499712</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>69632</Size>
<Path>C:\Program Files\7-Zip\7-zip.dll</Path>
<Version>9.22 beta</Version>
<Company>Igor Pavlov</Company>
<Description>7-Zip Shell Extension</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x60340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\culture.dll</Path>
<Version>2.0.50727.4927 (NetFXspW7.050727-4900)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Globalization Support</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x62bb0000</BaseAddress>
<Size>4898816</Size>
<Path>C:\Windows\System32\NLSData0009.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft English Natural Language Server Data and Code</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x65090000</BaseAddress>
<Size>2633728</Size>
<Path>C:\Windows\System32\NLSLexicons0009.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft English Natural Language Server Data and Code</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x67250000</BaseAddress>
<Size>1269760</Size>
<Path>C:\Windows\system32\comsvcs.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Services</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x67390000</BaseAddress>
<Size>663552</Size>
<Path>C:\Windows\System32\appwiz.cpl</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Application Manager</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x67a00000</BaseAddress>
<Size>1073152</Size>
<Path>C:\Windows\System32\werconcpl.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PRS CPL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x67b10000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\System32\wscui.cpl</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Action Center</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x67c30000</BaseAddress>
<Size>188416</Size>
<Path>C:\Windows\system32\MLANG.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi Language Support DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x67c70000</BaseAddress>
<Size>45056</Size>
<Path>C:\Program Files\Windows Media Player\wmpnssui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Player WMPNSS Shell Extensions</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x67c80000</BaseAddress>
<Size>49152</Size>
<Path>C:\Program Files\Windows Photo Viewer\PhotoBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Photo Base Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x67c90000</BaseAddress>
<Size>1466368</Size>
<Path>C:\Program Files\Windows Photo Viewer\PhotoViewer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Photo Viewer</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x67e00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\SYNCENG.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Briefcase Engine</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x67e20000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\syncui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Briefcase</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x67e50000</BaseAddress>
<Size>184320</Size>
<Path>C:\Program Files\WinRAR\rarext.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x67e80000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\twext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Previous Versions property page</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x68240000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\PhotoMetadataHandler.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Photo Metadata Handler</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x682a0000</BaseAddress>
<Size>811008</Size>
<Path>C:\Windows\System32\NaturalLanguage6.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Natural Language Development Platform 6</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x68410000</BaseAddress>
<Size>1511424</Size>
<Path>C:\Windows\system32\diskcopy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DiskCopy</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x68590000</BaseAddress>
<Size>3219456</Size>
<Path>C:\Windows\System32\mf.dll</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x68950000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\System32\StructuredQuery.dll</Path>
<Version>7.00.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Structured Query</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x68fa0000</BaseAddress>
<Size>839680</Size>
<Path>C:\Windows\system32\fontext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Font Folder</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x69070000</BaseAddress>
<Size>421888</Size>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Version>4.0.30319.237 (RTMGDR.030319-2300)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Runtime Execution Engine</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x690e0000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\mscoree.dll</Path>
<Version>4.0.40305.0 (Main.040305-0000)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Runtime Execution Engine</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x69170000</BaseAddress>
<Size>2326528</Size>
<Path>C:\Windows\system32\wpdshext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Portable Devices Shell Extension</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6a420000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\mmcshext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMC Shell Extension DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6a580000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\thumbcache.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Thumbnail Cache</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6a5f0000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\System32\hgcpl.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>HomeGroup Control Panel</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6a680000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\acppage.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Compatibility Tab Shell Extension Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6a6a0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\wmpshell.dll</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Player Launcher</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6a720000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\SearchFolder.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SearchFolder</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6b070000</BaseAddress>
<Size>929792</Size>
<Path>C:\Windows\system32\FXSRESM.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft  Fax Resource DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6b160000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\FXSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft  Fax API Support DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6b1a0000</BaseAddress>
<Size>860160</Size>
<Path>C:\Windows\system32\fxsst.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fax Service</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6b5a0000</BaseAddress>
<Size>188416</Size>
<Path>C:\Windows\System32\QAgent.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Quarantine Agent Proxy</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6b5d0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wwapi.dll</Path>
<Version>08.01.02.00 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WWAN API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6b5e0000</BaseAddress>
<Size>294912</Size>
<Path>C:\Windows\system32\wwanapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Mbnapi</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6ba70000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\mssprxy.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Search Proxy</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6bbf0000</BaseAddress>
<Size>315392</Size>
<Path>C:\Windows\System32\srchadmin.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Indexing Options</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6bc40000</BaseAddress>
<Size>9719808</Size>
<Path>C:\Windows\System32\ieframe.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Browser</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6c590000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\System32\cscobj.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>In-proc COM object used by clients of CSC API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6c670000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\PortableDeviceTypes.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Portable Device (Parameter) Types Component</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6c6a0000</BaseAddress>
<Size>118784</Size>
<Path>C:\Windows\system32\wpdshserviceobj.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Portable Device Shell Service Object</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6c6c0000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\QUtil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Quarantine Utilities</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6c6e0000</BaseAddress>
<Size>1761280</Size>
<Path>C:\Windows\System32\pnidui.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network System Icon</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6c8b0000</BaseAddress>
<Size>409600</Size>
<Path>C:\Windows\system32\dxp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Stage Shell Extension</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6ca80000</BaseAddress>
<Size>204800</Size>
<Path>C:\Program Files\Internet Explorer\ieproxy.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>IE ActiveX Interface Marshaling Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6cba0000</BaseAddress>
<Size>761856</Size>
<Path>C:\Windows\System32\Actioncenter.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Action Center</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6d5e0000</BaseAddress>
<Size>409600</Size>
<Path>C:\Windows\system32\imapi2.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Image Mastering API v2</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6d6e0000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\zipfldr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Compressed (zipped) Folders</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6d7a0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\AltTab.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Alt Tab</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6d7b0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\d3d8thk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Direct3D OS Thunk Layer</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6d7c0000</BaseAddress>
<Size>1847296</Size>
<Path>C:\Windows\system32\d3d9.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Direct3D 9 Runtime</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6d990000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\ehome\ehSSO.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Center Shell Service Object</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6dab0000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\System32\wercplsupport.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Problem Reports and Solutions</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6dfd0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\hcproviders.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Action Center Providers</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6dfe0000</BaseAddress>
<Size>106496</Size>
<Path>C:\Windows\System32\wscinterop.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Health Center WSC Interop</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6e3d0000</BaseAddress>
<Size>196608</Size>
<Path>C:\Windows\system32\wdmaud.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winmm  audio system driver</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6ecb0000</BaseAddress>
<Size>2588672</Size>
<Path>C:\Windows\System32\gameux.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Games Explorer</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6f320000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\System32\provsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HomeGroup</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6f3d0000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\Syncreg.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Synchronization Framework Registration</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6f450000</BaseAddress>
<Size>2154496</Size>
<Path>C:\Windows\System32\SyncCenter.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Sync Center</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6f660000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\msiltcfg.dll</Path>
<Version>5.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Installer Configuration API Stub</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6f670000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\midimap.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft MIDI Mapper</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\CSCAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6f950000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\CSCDLL.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Temporary Shim</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6f960000</BaseAddress>
<Size>434176</Size>
<Path>C:\Windows\System32\cscui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Side Caching UI</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6f9d0000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\system32\EhStorShell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Enhanced Storage Shell Extension DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6fa10000</BaseAddress>
<Size>409600</Size>
<Path>C:\Windows\system32\prnfldr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>prnfldr dll</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6fa80000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\msacm32.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Sound Mapper</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x6ffd0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashShell.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Shell Extension</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x70020000</BaseAddress>
<Size>1503232</Size>
<Path>C:\Windows\system32\EXPLORERFRAME.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ExplorerFrame</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x706f0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\IconCodecService.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Converts a PNG part of the icon to a legacy bmp icon</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x707f0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\sfc_os.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x70800000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\sfc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x70830000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\fdproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Function Discovery Proxy Dll</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x70870000</BaseAddress>
<Size>749568</Size>
<Path>C:\Windows\system32\BatMeter.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Battery Meter Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x70930000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\stobject.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Systray shell service object</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x70ac0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\System32\OLEACC.dll</Path>
<Version>7.0.0.0 (win7sp1_gdr.110826-1504)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Accessibility Core Component</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x70bd0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\sensapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SENS Connectivity API DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x70ef0000</BaseAddress>
<Size>2510848</Size>
<Path>C:\Windows\System32\netshell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Connections Shell</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x71830000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\WSCAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Center API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x72090000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\Wlanapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows WLAN AutoConfig Client Side API DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x72540000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wlanutil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Utility DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x72900000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\hhsetup.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® HTML Help</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\System32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\System32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x72a50000</BaseAddress>
<Size>1671168</Size>
<Path>C:\Windows\system32\NetworkExplorer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Explorer</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x72bf0000</BaseAddress>
<Size>1015808</Size>
<Path>C:\Windows\system32\CRYPTUI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust UI Provider</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x72cf0000</BaseAddress>
<Size>1798144</Size>
<Path>C:\Windows\system32\authui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Authentication UI</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x72eb0000</BaseAddress>
<Size>360448</Size>
<Path>C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Tablet PC Input Panel Text Services Framework</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x72f10000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\msls31.dll</Path>
<Version>3.10.349.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Line Services library file</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x72f40000</BaseAddress>
<Size>606208</Size>
<Path>C:\Windows\system32\MsftEdit.dll</Path>
<Version>5.41.21.2510</Version>
<Company>Microsoft Corporation</Company>
<Description>Rich Text Edit Control, v4.1</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x72fe0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\LINKINFO.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Volume Tracking</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73010000</BaseAddress>
<Size>634880</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll</Path>
<Version>8.00.50727.4940</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x731c0000</BaseAddress>
<Size>188416</Size>
<Path>C:\Windows\System32\shdocvw.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Doc Object and Control Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x731f0000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\actxprxy.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ActiveX Interface Marshaling Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73280000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINBRAND.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Branding Resources</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73290000</BaseAddress>
<Size>491520</Size>
<Path>C:\Windows\system32\timedate.cpl</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Time Date Control Panel Applet</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73310000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\HID.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Hid User Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73320000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\SndVolSSO.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SCA Volume</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73380000</BaseAddress>
<Size>122880</Size>
<Path>C:\Windows\System32\shacct.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Accounts Classes</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73400000</BaseAddress>
<Size>163840</Size>
<Path>C:\Windows\system32\RstrtMgr.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Restart Manager</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73470000</BaseAddress>
<Size>94208</Size>
<Path>C:\Program Files\Windows Sidebar\sbdrop.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Sidebar droptarget</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73550000</BaseAddress>
<Size>561152</Size>
<Path>C:\Windows\system32\PortableDeviceApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Portable Device API Components</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73630000</BaseAddress>
<Size>397312</Size>
<Path>C:\Windows\System32\wer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Error Reporting DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73750000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\ACLUI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Descriptor Editor</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73780000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\osbaseln.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Service Reporting API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x737c0000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\EhStorAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Enhanced Storage API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73950000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\System32\framedynos.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI SDK Provider Framework</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73da0000</BaseAddress>
<Size>364544</Size>
<Path>C:\Windows\System32\MFPlat.DLL</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation Platform DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\MSACM32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\AUDIOSES.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x740d0000</BaseAddress>
<Size>290816</Size>
<Path>C:\Windows\system32\es.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x741f0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\dsrole.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DS Role Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\System32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\system32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x744d0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\rtutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Routing Utilities</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\RASAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\XmlLite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\System32\MMDevApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74af0000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\DUser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUser Engine</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74b20000</BaseAddress>
<Size>729088</Size>
<Path>C:\Windows\system32\DUI70.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUI Engine</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75530000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\LOGONCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Logon Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\dnsapi.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75890000</BaseAddress>
<Size>270336</Size>
<Path>C:\Windows\System32\wevtapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eventing Consumption and Configuration API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\DEVRTL.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76f10000</BaseAddress>
<Size>172032</Size>
<Path>C:\Windows\system32\imagehlp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT Image Helper</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287356</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>222</ProcessIndex>
<ProcessId>2396</ProcessId>
<ParentProcessId>2188</ParentProcessId>
<ParentProcessIndex>223</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321760706810</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>RtWlan.exe</ProcessName>
<ImagePath>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtWlan.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtWlan.exe&quot; /H</CommandLine>
<CompanyName>ASUSTeK Computer Inc.</CompanyName>
<Version>1, 0, 0, 8</Version>
<Description></Description>
<modulelist>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>7585792</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtWlan.exe</Path>
<Version>1, 0, 0, 8</Version>
<Company>ASUSTeK Computer Inc.</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x2ac0000</BaseAddress>
<Size>241664</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtlIhvOid.dll</Path>
<Version>1, 1015, 826, 2010</Version>
<Company>Realtek</Company>
<Description>IHV OID (for Vista)</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x2b20000</BaseAddress>
<Size>217088</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\IpLib.dll</Path>
<Version>600, 1001, 1231, 2008</Version>
<Company>Realtek</Company>
<Description>IpLib</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x2fa0000</BaseAddress>
<Size>1081344</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\LIBEAY32.dll</Path>
<Version>0.9.8b</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x3240000</BaseAddress>
<Size>364544</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\EnumDevLib.dll</Path>
<Version>700, 1034, 1209, 2009</Version>
<Company></Company>
<Description>EnumDevLib DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x32a0000</BaseAddress>
<Size>49152</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtlICS.dll</Path>
<Version>600, 1008, 204, 2010</Version>
<Company>Realtek</Company>
<Description>RtlICS DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>630784</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtlLib.dll</Path>
<Version>700, 1066, 1208, 2010</Version>
<Company>Realtek Semiconductor Corp.</Company>
<Description>RtlLib DLL(IHV)</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x6f6e0000</BaseAddress>
<Size>421888</Size>
<Path>C:\Windows\system32\wlanui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Wireless Profile UI</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x6faa0000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\wlanhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Client Side Helper API</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x6fb50000</BaseAddress>
<Size>573440</Size>
<Path>C:\Windows\system32\ODBC32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ODBC Driver Manager</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x6fbe0000</BaseAddress>
<Size>1163264</Size>
<Path>C:\Windows\system32\MFC42.DLL</Path>
<Version>6.06.8063.0</Version>
<Company>Microsoft Corporation</Company>
<Description>MFCDLL Shared Library - Retail Version</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x70700000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\odbcint.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ODBC Resources</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x70a30000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\oledlg.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE User Interface Support</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\MSIMG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x72090000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\Wlanapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows WLAN AutoConfig Client Side API DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x72540000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wlanutil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Utility DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x72590000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\eappcfg.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eap Peer Config</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x725c0000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\eappprxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft EAPHost Peer Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x725e0000</BaseAddress>
<Size>212992</Size>
<Path>C:\Windows\system32\OneX.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IEEE 802.1X supplicant library</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\iphlpapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x74660000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\credui.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Manager User Interface</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x74b20000</BaseAddress>
<Size>729088</Size>
<Path>C:\Windows\system32\DUI70.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUI Engine</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x74be0000</BaseAddress>
<Size>1638400</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft GDI+</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\comdlg32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103569659001</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>223</ProcessIndex>
<ProcessId>2188</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321728414754</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>RtlService.exe</ProcessName>
<ImagePath>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtlService.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtlService.exe&quot;</CommandLine>
<CompanyName>Realtek</CompanyName>
<Version>700, 1006, 416, 2010</Version>
<Description>RtlService MFC Application</Description>
<modulelist>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>40960</Size>
<Path>C:\Program Files\ASUS\PCE-N15 WLAN Card Utilities\RtlService.exe</Path>
<Version>700, 1006, 416, 2010</Version>
<Company>Realtek</Company>
<Description>RtlService MFC Application</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x6fb50000</BaseAddress>
<Size>573440</Size>
<Path>C:\Windows\system32\ODBC32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ODBC Driver Manager</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x6fbe0000</BaseAddress>
<Size>1163264</Size>
<Path>C:\Windows\system32\MFC42.DLL</Path>
<Version>6.06.8063.0</Version>
<Company>Microsoft Corporation</Company>
<Description>MFCDLL Shared Library - Retail Version</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x70700000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\odbcint.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ODBC Resources</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287663</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>224</ProcessIndex>
<ProcessId>760</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321454744280</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k DcomLaunch</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130412103633078537</Timestamp>
<BaseAddress>0x2d0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\dllhost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM Surrogate</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x74280000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\wbem\wmiutils.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\FastProx.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x750d0000</BaseAddress>
<Size>143360</Size>
<Path>C:\Windows\system32\wbem\wmidcprv.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75a80000</BaseAddress>
<Size>389120</Size>
<Path>c:\windows\system32\rpcss.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Distributed COM Services</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75b40000</BaseAddress>
<Size>299008</Size>
<Path>c:\windows\system32\umpnpmgr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User-mode Plug-and-Play Service</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>c:\windows\system32\pcwum.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>c:\windows\system32\DEVRTL.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75bd0000</BaseAddress>
<Size>86016</Size>
<Path>c:\windows\system32\SPINF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SPINF</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>c:\windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>c:\windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103569659675</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>225</ProcessIndex>
<ProcessId>3236</ProcessId>
<ParentProcessId>3212</ParentProcessId>
<ParentProcessIndex>226</ParentProcessIndex>
<AuthenticationId>00000000:00021a24</AuthenticationId>
<CreateTime>130411322068027350</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>High</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>GUI.exe</ProcessName>
<ImagePath>C:\Program Files\GIGABYTE\ET6\GUI.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\GIGABYTE\ET6\GUI.exe&quot; -m</CommandLine>
<CompanyName></CompanyName>
<Version>1, 0, 0, 1</Version>
<Description>GUI MFC Application</Description>
<modulelist>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x200000</BaseAddress>
<Size>507904</Size>
<Path>C:\Program Files\GIGABYTE\ET6\work.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x290000</BaseAddress>
<Size>114688</Size>
<Path>C:\Program Files\GIGABYTE\ET6\SF.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>SF DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x2b0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Program Files\GIGABYTE\ET6\CIAMIB.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>CIAMIB DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x2d0000</BaseAddress>
<Size>102400</Size>
<Path>C:\Program Files\GIGABYTE\ET6\ycc.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>233472</Size>
<Path>C:\Program Files\GIGABYTE\ET6\GUI.exe</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>GUI MFC Application</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x440000</BaseAddress>
<Size>167936</Size>
<Path>C:\Program Files\GIGABYTE\ET6\OCK.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>OCK DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x470000</BaseAddress>
<Size>69632</Size>
<Path>C:\Program Files\GIGABYTE\ET6\GPTT.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x490000</BaseAddress>
<Size>106496</Size>
<Path>C:\Program Files\GIGABYTE\ET6\IccLibDll.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x4b0000</BaseAddress>
<Size>143360</Size>
<Path>C:\Program Files\GIGABYTE\ET6\StabilityLib.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>StabilityLib DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x4e0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Program Files\GIGABYTE\ET6\HM.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>HM DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x500000</BaseAddress>
<Size>221184</Size>
<Path>C:\Program Files\GIGABYTE\ET6\GVTunner.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>GVTunner DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x540000</BaseAddress>
<Size>114688</Size>
<Path>C:\Program Files\GIGABYTE\ET6\Sound.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x560000</BaseAddress>
<Size>118784</Size>
<Path>C:\Program Files\GIGABYTE\ET6\AMD8.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>AMD8 DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x5d0000</BaseAddress>
<Size>4448256</Size>
<Path>C:\Program Files\GIGABYTE\ET6\Platform.dll</Path>
<Version>3.1.0</Version>
<Company></Company>
<Description>Platform Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0xa10000</BaseAddress>
<Size>462848</Size>
<Path>C:\Program Files\GIGABYTE\ET6\Device.dll</Path>
<Version>3.1.0</Version>
<Company></Company>
<Description>Device Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x1b60000</BaseAddress>
<Size>327680</Size>
<Path>C:\Program Files\GIGABYTE\ET6\MFCCPU.DLL</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>MFCCPU DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>2682880</Size>
<Path>C:\Program Files\GIGABYTE\ET6\Normal.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>Normal DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x6e3d0000</BaseAddress>
<Size>196608</Size>
<Path>C:\Windows\system32\wdmaud.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winmm  audio system driver</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x6f670000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\midimap.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft MIDI Mapper</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x6fa80000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\msacm32.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Sound Mapper</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x70a30000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\oledlg.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE User Interface Support</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x72ff0000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\OLEPRO32.DLL</Path>
<Version>6.1.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x73010000</BaseAddress>
<Size>634880</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll</Path>
<Version>8.00.50727.4940</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x730b0000</BaseAddress>
<Size>552960</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCP80.dll</Path>
<Version>8.00.50727.4940</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C++ Runtime Library</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x73240000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\pdh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Performance Data Helper DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\MSACM32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\AUDIOSES.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\system32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\system32\MMDevAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\comdlg32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103570442409</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>227</ProcessIndex>
<ProcessId>356</ProcessId>
<ParentProcessId>4</ParentProcessId>
<ParentProcessIndex>215</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321373624138</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>smss.exe</ProcessName>
<ImagePath>C:\Windows\System32\smss.exe</ImagePath>
<CommandLine>\SystemRoot\System32\smss.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Session Manager</Description>
<modulelist>
<module>
<Timestamp>130412103571286055</Timestamp>
<BaseAddress>0x47a00000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\System32\smss.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Session Manager</Description>
</module>
<module>
<Timestamp>130412103571286055</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>228</ProcessIndex>
<ProcessId>468</ProcessId>
<ParentProcessId>440</ParentProcessId>
<ParentProcessIndex>229</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321420268220</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>csrss.exe</ProcessName>
<ImagePath>C:\Windows\system32\csrss.exe</ImagePath>
<CommandLine>%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Client Server Runtime Process</Description>
<modulelist>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x4a1e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\csrss.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Server Runtime Process</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\sxs.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x75ec0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\sxssrv.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SxS Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x75ed0000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\winsrv.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x75f00000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\basesrv.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x75f10000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\CSRSRV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Server Runtime Process</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\SYSTEM32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286122</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>230</ProcessIndex>
<ProcessId>552</ProcessId>
<ParentProcessId>440</ParentProcessId>
<ParentProcessIndex>229</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321451624275</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>wininit.exe</ProcessName>
<ImagePath>C:\Windows\system32\wininit.exe</ImagePath>
<CommandLine>wininit.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Start-Up Application</Description>
<modulelist>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x290000</BaseAddress>
<Size>106496</Size>
<Path>C:\Windows\system32\wininit.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Start-Up Application</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286187</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>231</ProcessIndex>
<ProcessId>560</ProcessId>
<ParentProcessId>544</ParentProcessId>
<ParentProcessIndex>232</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321451624275</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>csrss.exe</ProcessName>
<ImagePath>C:\Windows\system32\csrss.exe</ImagePath>
<CommandLine>%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Client Server Runtime Process</Description>
<modulelist>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x4a1e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\csrss.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Server Runtime Process</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\sxs.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x75ec0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\sxssrv.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SxS Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x75ed0000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\winsrv.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x75f00000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\basesrv.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x75f10000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\CSRSRV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Server Runtime Process</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\SYSTEM32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286246</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>233</ProcessIndex>
<ProcessId>632</ProcessId>
<ParentProcessId>552</ParentProcessId>
<ParentProcessIndex>230</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321452560276</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>lsass.exe</ProcessName>
<ImagePath>C:\Windows\system32\lsass.exe</ImagePath>
<CommandLine>C:\Windows\system32\lsass.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Local Security Authority Process</Description>
<modulelist>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0xf90000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\lsass.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Local Security Authority Process</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x6d5c0000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\certpoleng.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Certificate Policy Engine</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x72930000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\keyiso.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>CNG Key Isolation Service</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x733a0000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\dssenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75390000</BaseAddress>
<Size>188416</Size>
<Path>C:\Windows\system32\scecli.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Configuration Editor Client Engine</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75400000</BaseAddress>
<Size>212992</Size>
<Path>C:\Windows\system32\pku2u.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Pku2u Security Package</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75440000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\tspkg.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Service Security Package</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75470000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\efslsaext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LSA extension for EFS</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x754c0000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\wdigest.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Digest Access</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x754f0000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\schannel.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TLS / SSL Security Provider</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75530000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\logoncli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Logon Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x755b0000</BaseAddress>
<Size>573440</Size>
<Path>C:\Windows\system32\netlogon.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Logon Services DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75640000</BaseAddress>
<Size>270336</Size>
<Path>C:\Windows\system32\msv1_0.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Authentication Package v1.0</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75700000</BaseAddress>
<Size>557056</Size>
<Path>C:\Windows\system32\kerberos.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kerberos Security Package</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75790000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\negoexts.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NegoExtender Security Package</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x757b0000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\netjoin.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Domain Join DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x757e0000</BaseAddress>
<Size>8192</Size>
<Path>C:\Windows\system32\msprivs.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Privilege Translations</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75860000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\AUTHZ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Authorization Framework</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75880000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\cngaudit.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Next Generation audit library</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75890000</BaseAddress>
<Size>270336</Size>
<Path>C:\Windows\system32\wevtapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eventing Consumption and Configuration API</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75940000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\cryptdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptography Manager</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75960000</BaseAddress>
<Size>569344</Size>
<Path>C:\Windows\system32\SAMSRV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75d20000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\SspiSrv.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>LSA SSPI RPC interface DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286373</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>234</ProcessIndex>
<ProcessId>644</ProcessId>
<ParentProcessId>552</ParentProcessId>
<ParentProcessIndex>230</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321452716277</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>lsm.exe</ProcessName>
<ImagePath>C:\Windows\system32\lsm.exe</ImagePath>
<CommandLine>C:\Windows\system32\lsm.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Local Session Manager Service</Description>
<modulelist>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0xcd0000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\lsm.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Local Session Manager Service</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x75b90000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\WMsgAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WinLogon IPC Client</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x75ba0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\SYSNTFY.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Notifications Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\pcwum.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286429</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>235</ProcessIndex>
<ProcessId>880</ProcessId>
<ParentProcessId>544</ParentProcessId>
<ParentProcessIndex>232</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321455836282</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>winlogon.exe</ProcessName>
<ImagePath>C:\Windows\system32\winlogon.exe</ImagePath>
<CommandLine>winlogon.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Description>Windows Logon Application</Description>
<modulelist>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x430000</BaseAddress>
<Size>294912</Size>
<Path>C:\Windows\system32\winlogon.exe</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Logon Application</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x73e00000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\UXINIT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows User Experience Session Initialization Dll</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x757b0000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\netjoin.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Domain Join DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286491</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>236</ProcessIndex>
<ProcessId>908</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e4</AuthenticationId>
<CreateTime>130411321456304283</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\NETWORK SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k RPCSS</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75a70000</BaseAddress>
<Size>57344</Size>
<Path>c:\windows\system32\rpcepmap.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>RPC Endpoint Mapper</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75a80000</BaseAddress>
<Size>389120</Size>
<Path>c:\windows\system32\rpcss.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Distributed COM Services</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286548</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>237</ProcessIndex>
<ProcessId>972</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321456460283</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>atiesrxx.exe</ProcessName>
<ImagePath>C:\Windows\system32\atiesrxx.exe</ImagePath>
<CommandLine>C:\Windows\system32\atiesrxx.exe</CommandLine>
<CompanyName>AMD</CompanyName>
<Version>6.14.11.1110</Version>
<Description>AMD External Events Service Module</Description>
<modulelist>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\atiesrxx.exe</Path>
<Version>6.14.11.1110</Version>
<Company>AMD</Company>
<Description>AMD External Events Service Module</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286607</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>238</ProcessIndex>
<ProcessId>1056</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e5</AuthenticationId>
<CreateTime>130411321456928284</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\LOCAL SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\System32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x67580000</BaseAddress>
<Size>581632</Size>
<Path>C:\Windows\system32\wuapi.dll</Path>
<Version>7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Update Client API</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x67760000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\Cabinet.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Cabinet File API</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>c:\windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x68e00000</BaseAddress>
<Size>1417216</Size>
<Path>C:\Windows\system32\WMALFXGFXDSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SysFx DSP</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x70c40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\winrnr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LDAP RnR Provider DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x70c50000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\pnrpnsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PNRP Name Space Provider</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x70c70000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\napinsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>E-mail Naming Shim Provider</Description>
</module>
<module>
<Timestamp>130412103651337111</Timestamp>
<BaseAddress>0x71770000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\System32\aeevts.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Experience Event Resources</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x72840000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\System32\dhcpcore6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\System32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x72980000</BaseAddress>
<Size>24576</Size>
<Path>c:\windows\system32\nrpsrv.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Name Resolution Proxy (NRP) RPC interface</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>c:\windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x729d0000</BaseAddress>
<Size>32768</Size>
<Path>c:\windows\system32\lmhsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>TCPIP NetBios Transport Services DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x73820000</BaseAddress>
<Size>81920</Size>
<Path>c:\windows\system32\wscsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Center Service</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x73da0000</BaseAddress>
<Size>364544</Size>
<Path>C:\Windows\System32\mfplat.DLL</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation Platform DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\System32\audioses.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\NLAapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\System32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x74420000</BaseAddress>
<Size>466944</Size>
<Path>C:\Windows\System32\audiokse.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Ks Endpoint</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x74790000</BaseAddress>
<Size>499712</Size>
<Path>c:\windows\system32\audiosrv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Audio Service</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x74910000</BaseAddress>
<Size>1097728</Size>
<Path>c:\windows\system32\wevtsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Event Logging Service</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>c:\windows\system32\MMDevAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>c:\windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\System32\firewallapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>c:\windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>c:\windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76f10000</BaseAddress>
<Size>172032</Size>
<Path>C:\Windows\system32\imagehlp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT Image Helper</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286669</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>239</ProcessIndex>
<ProcessId>1088</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321457084284</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\System32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x6b630000</BaseAddress>
<Size>790528</Size>
<Path>C:\Windows\System32\RASDLG.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Common Dialog API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x6c590000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\cscobj.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>In-proc COM object used by clients of CSC API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x70ee0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\pcadm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Program Compatibility Assistant Diagnostic Module</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x70ef0000</BaseAddress>
<Size>2510848</Size>
<Path>C:\Windows\System32\netshell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Connections Shell</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x72020000</BaseAddress>
<Size>421888</Size>
<Path>C:\Windows\system32\netcfgx.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Configuration Objects</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x723b0000</BaseAddress>
<Size>1409024</Size>
<Path>C:\Windows\System32\msxml6.dll</Path>
<Version>6.30.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 6.0 SP3</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x72510000</BaseAddress>
<Size>143360</Size>
<Path>c:\windows\system32\WinSCard.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Smart Card API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x72540000</BaseAddress>
<Size>24576</Size>
<Path>c:\windows\system32\wlanutil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Utility DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x72550000</BaseAddress>
<Size>69632</Size>
<Path>c:\windows\system32\l2gpstore.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Policy Storage dll</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x72590000</BaseAddress>
<Size>192512</Size>
<Path>c:\windows\system32\eappcfg.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eap Peer Config</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x725c0000</BaseAddress>
<Size>69632</Size>
<Path>c:\windows\system32\eappprxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft EAPHost Peer Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x725e0000</BaseAddress>
<Size>212992</Size>
<Path>c:\windows\system32\OneX.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IEEE 802.1X supplicant library</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x72620000</BaseAddress>
<Size>430080</Size>
<Path>c:\windows\system32\WLANSEC.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 MSM Security Module DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x72690000</BaseAddress>
<Size>442368</Size>
<Path>c:\windows\system32\WLANMSM.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 MSM DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x72700000</BaseAddress>
<Size>839680</Size>
<Path>c:\windows\system32\wlansvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows WLAN AutoConfig Service DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>c:\windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>c:\windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x73430000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\MPRAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MP Router Administration DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x734f0000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\System32\portabledeviceconnectapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Portable Device Connection API Components</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x73550000</BaseAddress>
<Size>561152</Size>
<Path>C:\Windows\system32\PortableDeviceApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Portable Device API Components</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x73840000</BaseAddress>
<Size>290816</Size>
<Path>c:\windows\system32\netman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Connections Manager</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x73890000</BaseAddress>
<Size>86016</Size>
<Path>c:\windows\system32\wdi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Diagnostic Infrastructure</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x73c20000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\hnetcfg.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Home Networking Configuration Manager</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74020000</BaseAddress>
<Size>176128</Size>
<Path>c:\windows\system32\WUDFPlatform.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Driver Foundation - User-mode Platform Library</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74050000</BaseAddress>
<Size>81920</Size>
<Path>c:\windows\system32\wudfsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Driver Foundation - User-mode Driver Framework Service</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74070000</BaseAddress>
<Size>45056</Size>
<Path>c:\windows\system32\uxsms.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft User Experience Session Management Service</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74120000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\System32\mstask.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler interface DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74160000</BaseAddress>
<Size>512000</Size>
<Path>C:\Windows\system32\taskschd.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler COM API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x741f0000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\dsrole.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DS Role Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74230000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\System32\PeerDist.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>BranchCache Client Library</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\System32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74380000</BaseAddress>
<Size>557056</Size>
<Path>c:\windows\system32\cscsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>CSC Service DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\System32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x744d0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\rtutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Routing Utilities</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\System32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\System32\RASAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74790000</BaseAddress>
<Size>499712</Size>
<Path>c:\windows\system32\audiosrv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Audio Service</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>c:\windows\system32\MMDevAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>c:\windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x751b0000</BaseAddress>
<Size>1171456</Size>
<Path>c:\windows\system32\sysmain.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Superfetch Service Host</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75700000</BaseAddress>
<Size>557056</Size>
<Path>C:\Windows\system32\kerberos.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Kerberos Security Package</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>c:\windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75860000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\AUTHZ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Authorization Framework</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75890000</BaseAddress>
<Size>270336</Size>
<Path>c:\windows\system32\wevtapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eventing Consumption and Configuration API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75940000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\System32\cryptdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptography Manager</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x759f0000</BaseAddress>
<Size>86016</Size>
<Path>c:\windows\system32\trkwks.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Distributed Link Tracking Client</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>c:\windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>c:\windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75ba0000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\SYSNTFY.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Notifications Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\pcwum.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\devrtl.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>c:\windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286726</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>240</ProcessIndex>
<ProcessId>1136</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321457240285</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k netsvcs</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130412103633319164</Timestamp>
<BaseAddress>0x22c0000</BaseAddress>
<Size>499712</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x67440000</BaseAddress>
<Size>1257472</Size>
<Path>C:\Windows\System32\msxml3.dll</Path>
<Version>8.110.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 3.0 SP11</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x67750000</BaseAddress>
<Size>49152</Size>
<Path>c:\windows\system32\mspatcha.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft File Patch Application API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x67760000</BaseAddress>
<Size>86016</Size>
<Path>c:\windows\system32\Cabinet.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Cabinet File API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x67780000</BaseAddress>
<Size>1941504</Size>
<Path>c:\windows\system32\wuaueng.dll</Path>
<Version>7.6.7600.256 (winmain_wtr_wsus3sp2(oobla).120602-1459)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Update Agent</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x67c60000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\wbem\ncprov.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Non-COM WMI Event Provision APIs</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x68a00000</BaseAddress>
<Size>212992</Size>
<Path>c:\windows\system32\adsldpc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ADs LDAP Provider C DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x6a3b0000</BaseAddress>
<Size>163840</Size>
<Path>c:\windows\system32\appmgmts.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software installation Service</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x6aff0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\NCI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>CoInstaller: NET</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x6b590000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\vss_ps.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Service proxy/stub</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x6b740000</BaseAddress>
<Size>1716224</Size>
<Path>c:\windows\system32\ESENT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Extensible Storage Engine for Microsoft(R) Windows(R)</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x6d6b0000</BaseAddress>
<Size>73728</Size>
<Path>c:\windows\system32\mmcss.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Class Scheduler Service</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x6d740000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\SPFILEQ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SPFILEQ</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x6f680000</BaseAddress>
<Size>368640</Size>
<Path>C:\Windows\System32\netprofm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x6f7b0000</BaseAddress>
<Size>1138688</Size>
<Path>C:\Windows\system32\VSSAPI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Requestor/Writer Services API DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x6fad0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\SSDPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SSDP Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x701a0000</BaseAddress>
<Size>73728</Size>
<Path>c:\windows\system32\aelupsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Experience Service</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x706b0000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\VssTrace.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Service Tracing Library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>c:\windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x70be0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\cryptnet.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto Network Related API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x71630000</BaseAddress>
<Size>315392</Size>
<Path>C:\Windows\system32\taskcomp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler Backward Compatibility Plug-in</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x71850000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\ktmw32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows KTM Win32 Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x71860000</BaseAddress>
<Size>761856</Size>
<Path>c:\windows\system32\schedsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler Service</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x71cf0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\wiarpc.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Acquisition RPC client DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x71d00000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\FVECERTS.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>BitLocker Certificates Library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x71d10000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\tbs.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>TBS</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x71d20000</BaseAddress>
<Size>274432</Size>
<Path>C:\Windows\system32\FVEAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows BitLocker Drive Encryption API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x71dc0000</BaseAddress>
<Size>335872</Size>
<Path>c:\windows\system32\shsvcs.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Services Dll</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\system32\WINHTTP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x727d0000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\umb.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Mode Bus Driver Interface Dll</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x727e0000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\eapphost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft EAPHost Peer service</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x72820000</BaseAddress>
<Size>106496</Size>
<Path>c:\windows\system32\eapsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft EAPHost service</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>c:\windows\system32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x73360000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\qmgrprxy.dll</Path>
<Version>7.5.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Background Intelligent Transfer Service Proxy</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x733a0000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\dssenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x73490000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\upnp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>UPnP Control Point API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x734d0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\bitsigd.dll</Path>
<Version>7.5.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Background Intelligent Transfer Service IGD Support</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x73510000</BaseAddress>
<Size>61440</Size>
<Path>c:\windows\system32\appinfo.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Information Service</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x73530000</BaseAddress>
<Size>32768</Size>
<Path>c:\windows\system32\bitsperf.dll</Path>
<Version>7.5.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Perfmon Counter Access</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x73630000</BaseAddress>
<Size>397312</Size>
<Path>C:\Windows\system32\wer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Error Reporting DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x737f0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\tschannel.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler Proxy</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x738b0000</BaseAddress>
<Size>598016</Size>
<Path>c:\windows\system32\qmgr.dll</Path>
<Version>7.5.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Background Intelligent Transfer Service</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x73ae0000</BaseAddress>
<Size>352256</Size>
<Path>C:\Windows\system32\wbem\wbemess.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x73b40000</BaseAddress>
<Size>528384</Size>
<Path>C:\Windows\system32\wbem\wmiprvsd.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x73bd0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\wbem\repdrvfs.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Repository Driver</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x73c70000</BaseAddress>
<Size>794624</Size>
<Path>C:\Windows\system32\wbem\wbemcore.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Management Instrumentation</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74080000</BaseAddress>
<Size>61440</Size>
<Path>c:\windows\system32\sens.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>System Event Notification Service (SENS)</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x741f0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\dsrole.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DS Role Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>c:\windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74220000</BaseAddress>
<Size>49152</Size>
<Path>c:\windows\system32\themeservice.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Theme Service Dll</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>c:\windows\system32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74280000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\wbem\wmiutils.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x742e0000</BaseAddress>
<Size>602112</Size>
<Path>c:\windows\system32\gpsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x744d0000</BaseAddress>
<Size>53248</Size>
<Path>c:\windows\system32\rtutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Routing Utilities</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\RasApi32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74560000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\NCObjAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74570000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\wbem\esscli.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x745c0000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\CLUSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cluster API Library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74690000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\RESUTILS.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Cluster Resource Utility DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x746b0000</BaseAddress>
<Size>110592</Size>
<Path>c:\windows\system32\browser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Computer Browser Service DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x746d0000</BaseAddress>
<Size>180224</Size>
<Path>c:\windows\system32\srvsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74700000</BaseAddress>
<Size>204800</Size>
<Path>c:\windows\system32\WDSCORE.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Panther Engine Module</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74760000</BaseAddress>
<Size>176128</Size>
<Path>c:\windows\system32\profsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ProfSvc</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>c:\windows\system32\XmlLite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74ab0000</BaseAddress>
<Size>208896</Size>
<Path>c:\windows\system32\sqmapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>SQM Client</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\FastProx.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75100000</BaseAddress>
<Size>512000</Size>
<Path>c:\windows\system32\iphlpsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Service that offers IPv6 connectivity over an IPv4 network.</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75180000</BaseAddress>
<Size>176128</Size>
<Path>c:\windows\system32\wbem\wmisvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>c:\windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75350000</BaseAddress>
<Size>180224</Size>
<Path>c:\windows\system32\UBPM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unified Background Process Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x754f0000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\schannel.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TLS / SSL Security Provider</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75530000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\LOGONCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Logon Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x757b0000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\netjoin.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Domain Join DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x757f0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\SSCORE.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Core DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75860000</BaseAddress>
<Size>110592</Size>
<Path>c:\windows\system32\AUTHZ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Authorization Framework</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75890000</BaseAddress>
<Size>270336</Size>
<Path>c:\windows\system32\wevtapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eventing Consumption and Configuration API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75940000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\cryptdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptography Manager</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>c:\windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>c:\windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75b90000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\WMsgAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WinLogon IPC Client</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75ba0000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\SYSNTFY.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Notifications Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>c:\windows\system32\pcwum.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\devrtl.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75bd0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\SPINF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SPINF</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>c:\windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>c:\windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>c:\windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\psapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286788</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>241</ProcessIndex>
<ProcessId>1288</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e5</AuthenticationId>
<CreateTime>130411321459580289</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\LOCAL SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k LocalService</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x67ef0000</BaseAddress>
<Size>1126400</Size>
<Path>C:\Windows\system32\sppcext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Protection Platform Client Extension Dll</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x68d70000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\TAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Windows(TM) Telephony API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x68db0000</BaseAddress>
<Size>208896</Size>
<Path>C:\Windows\system32\sppcomapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Library</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x6a5d0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\slwga.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing WGA API</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x6a640000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\sppc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x6f680000</BaseAddress>
<Size>368640</Size>
<Path>c:\windows\system32\netprofm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x6fd90000</BaseAddress>
<Size>2359296</Size>
<Path>C:\Windows\system32\msi.dll</Path>
<Version>5.0.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Installer</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x707f0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\sfc_os.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x70800000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\sfc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x70c40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\winrnr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LDAP RnR Provider DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x70c50000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\pnrpnsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PNRP Name Space Provider</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x70c70000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\napinsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>E-mail Naming Shim Provider</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\system32\winhttp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x72510000</BaseAddress>
<Size>143360</Size>
<Path>C:\Windows\system32\WinSCard.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Smart Card API</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x729a0000</BaseAddress>
<Size>32768</Size>
<Path>c:\windows\system32\nsisvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Interface RPC server</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x72bf0000</BaseAddress>
<Size>1015808</Size>
<Path>C:\Windows\system32\CRYPTUI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust UI Provider</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x735e0000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\AEPIC.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Experience Program Cache</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x73630000</BaseAddress>
<Size>397312</Size>
<Path>C:\Windows\system32\wer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Error Reporting DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x736b0000</BaseAddress>
<Size>589824</Size>
<Path>C:\Windows\system32\perftrack.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Performance PerfTrack</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x73890000</BaseAddress>
<Size>86016</Size>
<Path>c:\windows\system32\wdi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Diagnostic Infrastructure</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x740d0000</BaseAddress>
<Size>290816</Size>
<Path>c:\windows\system32\es.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>c:\windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>c:\windows\system32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\RASAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\System32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>c:\windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286850</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>242</ProcessIndex>
<ProcessId>1400</ProcessId>
<ParentProcessId>972</ParentProcessId>
<ParentProcessIndex>237</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321460204290</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>atieclxx.exe</ProcessName>
<ImagePath>C:\Windows\system32\atieclxx.exe</ImagePath>
<CommandLine>atieclxx</CommandLine>
<CompanyName>AMD</CompanyName>
<Version>6.14.11.1110</Version>
<Description>AMD External Events Client Module</Description>
<modulelist>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>425984</Size>
<Path>C:\Windows\system32\atieclxx.exe</Path>
<Version>6.14.11.1110</Version>
<Company>AMD</Company>
<Description>AMD External Events Client Module</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x73d40000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\atiadlxx.dll</Path>
<Version>6.14.10.1081</Version>
<Company>Advanced Micro Devices, Inc.</Company>
<Description>ADL</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286909</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>243</ProcessIndex>
<ProcessId>1544</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e4</AuthenticationId>
<CreateTime>130411321461752302</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\NETWORK SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k NetworkService</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x67440000</BaseAddress>
<Size>1257472</Size>
<Path>C:\Windows\System32\msxml3.dll</Path>
<Version>8.110.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 3.0 SP11</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x67760000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\Cabinet.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Cabinet File API</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x6a6c0000</BaseAddress>
<Size>143360</Size>
<Path>c:\windows\system32\dnsrslvr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Caching Resolver Service</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x6b590000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\vss_ps.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Service proxy/stub</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x6b740000</BaseAddress>
<Size>1716224</Size>
<Path>C:\Windows\system32\ESENT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Extensible Storage Engine for Microsoft(R) Windows(R)</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x6f7b0000</BaseAddress>
<Size>1138688</Size>
<Path>C:\Windows\system32\VSSAPI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Requestor/Writer Services API DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x6fad0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\ssdpapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SSDP Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x6fae0000</BaseAddress>
<Size>163840</Size>
<Path>c:\windows\system32\ncsi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Connectivity Status Indicator</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x6fb10000</BaseAddress>
<Size>253952</Size>
<Path>c:\windows\system32\nlasvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x706c0000</BaseAddress>
<Size>147456</Size>
<Path>c:\windows\system32\cryptsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Services</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x70750000</BaseAddress>
<Size>94208</Size>
<Path>c:\windows\system32\wkssvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x70bd0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\SensApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SENS Connectivity API DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x70be0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\CRYPTNET.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto Network Related API</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>c:\windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>c:\windows\system32\WINHTTP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\Fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>c:\windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\iphlpapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x73800000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\dnsext.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS extension DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x740d0000</BaseAddress>
<Size>290816</Size>
<Path>C:\Windows\system32\es.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>c:\windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x757b0000</BaseAddress>
<Size>176128</Size>
<Path>c:\windows\system32\netjoin.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Domain Join DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75890000</BaseAddress>
<Size>270336</Size>
<Path>c:\windows\system32\wevtapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eventing Consumption and Configuration API</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\DEVRTL.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\psapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571286965</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>244</ProcessIndex>
<ProcessId>1624</ProcessId>
<ParentProcessId>1088</ParentProcessId>
<ParentProcessIndex>239</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321474152320</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>WLANExt.exe</ProcessName>
<ImagePath>C:\Windows\system32\WLANExt.exe</ImagePath>
<CommandLine>C:\Windows\system32\WLANExt.exe 22197176</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Wireless LAN 802.11 Extensibility Framework</Description>
<modulelist>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x6c0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\WLANExt.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Extensibility Framework</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>626688</Size>
<Path>C:\Windows\system32\Rtlihvs.dll</Path>
<Version>600, 1002, 508, 2008</Version>
<Company>Realtek Semiconductor Corp. </Company>
<Description>Realtek CCX SDK IHV Service</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x72090000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\Wlanapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows WLAN AutoConfig Client Side API DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x72540000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wlanutil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Utility DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\XmlLite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287027</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>245</ProcessIndex>
<ProcessId>1632</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321474552320</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>AvastSvc.exe</ProcessName>
<ImagePath>C:\Program Files\AVAST Software\Avast\AvastSvc.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\AVAST Software\Avast\AvastSvc.exe&quot;</CommandLine>
<CompanyName>AVAST Software</CompanyName>
<Version>8.0.1506.399</Version>
<Description>avast! Service</Description>
<modulelist>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0xd0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Program Files\AVAST Software\Avast\AvastSvc.exe</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Service</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x63090000</BaseAddress>
<Size>2293760</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040504\algo.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x64740000</BaseAddress>
<Size>434176</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040504\aswFiDb.dll</Path>
<Version>7.0.1506.263</Version>
<Company>AVAST Software</Company>
<Description>File information database access</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x648f0000</BaseAddress>
<Size>401408</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040504\swhealthex.dll</Path>
<Version>7.0.1506.285</Version>
<Company>AVAST Software</Company>
<Description>Software Health extension library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x649d0000</BaseAddress>
<Size>344064</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040504\aswRep.dll</Path>
<Version>7.0.1506.285</Version>
<Company>AVAST Software</Company>
<Description>Reputation services access</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x64a30000</BaseAddress>
<Size>421888</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040504\aswCmnBS.dll</Path>
<Version>7.0.1506.285</Version>
<Company>AVAST Software</Company>
<Description>Common functions</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x64aa0000</BaseAddress>
<Size>1351680</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040504\aswEngin.dll</Path>
<Version>7.0.1506.285</Version>
<Company>AVAST Software</Company>
<Description>High level antivirus engine</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x671f0000</BaseAddress>
<Size>348160</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040504\aswCmnIS.dll</Path>
<Version>7.0.1506.285</Version>
<Company>AVAST Software</Company>
<Description>Antivirus independent functions</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x6b540000</BaseAddress>
<Size>159744</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040504\aswScan.dll</Path>
<Version>7.0.1506.270</Version>
<Company>AVAST Software</Company>
<Description>Low level antivirus engine</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x6daa0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\wscproxystub.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Center ISV Proxy Stub</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\mpr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70590000</BaseAddress>
<Size>933888</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswpatchmgt.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Software Health framework library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70bd0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\SensApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SENS Connectivity API DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70be0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\cryptnet.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto Network Related API</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70c00000</BaseAddress>
<Size>94208</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashWsFtr.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Web Shield Filter Module</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70c20000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\security.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70c40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\winrnr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LDAP RnR Provider DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70c50000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\pnrpnsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PNRP Name Space Provider</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70c80000</BaseAddress>
<Size>376832</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashWebSv.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Web Scanner</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70ce0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wshqos.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>QoS Winsock2 Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70cf0000</BaseAddress>
<Size>1191936</Size>
<Path>C:\Program Files\AVAST Software\Avast\LIBEAY32.dll</Path>
<Version>1.0.1c</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70e20000</BaseAddress>
<Size>282624</Size>
<Path>C:\Program Files\AVAST Software\Avast\SSLEAY32.dll</Path>
<Version>1.0.1c</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70e70000</BaseAddress>
<Size>430080</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashMaiSv.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! e-Mail Scanner Service</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x70ef0000</BaseAddress>
<Size>2510848</Size>
<Path>C:\Windows\system32\netshell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Connections Shell</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71160000</BaseAddress>
<Size>118784</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResWS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! HTTP Scanner AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71180000</BaseAddress>
<Size>98304</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResStd.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Standard Shield  AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x711a0000</BaseAddress>
<Size>98304</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResP2P.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! P2P Shield AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x711c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResNS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Network Shield AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71200000</BaseAddress>
<Size>98304</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResMes.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Messenger scanner AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71220000</BaseAddress>
<Size>69632</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResMai.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! e-Mail Scanner AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71240000</BaseAddress>
<Size>36864</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResJs.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Script Blocking AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71250000</BaseAddress>
<Size>73728</Size>
<Path>C:\Program Files\AVAST Software\Avast\AhResBhv.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Behavior Shield AAVM Provider Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71830000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\WSCAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Center API</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71840000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\wscisvif.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Center ISV API</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71920000</BaseAddress>
<Size>274432</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswStrm.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Streaming Update library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71970000</BaseAddress>
<Size>118784</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswDld.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>aswDld Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswIdle.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Idle Hook Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x719a0000</BaseAddress>
<Size>77824</Size>
<Path>C:\Program Files\AVAST Software\Avast\avastIP.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>aswDld Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x719c0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\FltLib.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Filter Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x719d0000</BaseAddress>
<Size>921600</Size>
<Path>C:\Program Files\AVAST Software\Avast\Aavm4h.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Asynchronous Virus Monitor (AAVM)</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71ac0000</BaseAddress>
<Size>151552</Size>
<Path>C:\Program Files\AVAST Software\Avast\AavmRpch.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! AAVM Remote Procedure Call Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71af0000</BaseAddress>
<Size>479232</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswSqLt.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! SQLite library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71b70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswLog.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Log library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71bc0000</BaseAddress>
<Size>163840</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashTask.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Task Handling Module</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71bf0000</BaseAddress>
<Size>688128</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswAux.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Auxiliary Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71ca0000</BaseAddress>
<Size>270336</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswProperty.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Property Storage library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71d70000</BaseAddress>
<Size>290816</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashServ.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! antivirus service</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\system32\WINHTTP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x71ee0000</BaseAddress>
<Size>1183744</Size>
<Path>C:\Program Files\AVAST Software\Avast\dbghelp.dll</Path>
<Version>6.11.0001.404 (debuggers(dbg).090225-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x72010000</BaseAddress>
<Size>57344</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswEngLdr.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Antivirus engine loader</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x72090000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\wlanapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows WLAN AutoConfig Client Side API DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x720c0000</BaseAddress>
<Size>970752</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashBase.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Basic Functionality Module</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x721b0000</BaseAddress>
<Size>581632</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCP90.dll</Path>
<Version>9.00.30729.6161</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C++ Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x72240000</BaseAddress>
<Size>667648</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll</Path>
<Version>9.00.30729.6161</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x722f0000</BaseAddress>
<Size>212992</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswCmnIS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Antivirus independent functions</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x72330000</BaseAddress>
<Size>126976</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswCmnOS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Antivirus HW dependent library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x72350000</BaseAddress>
<Size>389120</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswCmnBS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Common functions</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x72540000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wlanutil.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Wireless LAN 802.11 Utility DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x72910000</BaseAddress>
<Size>126976</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040504\aswCmnOS.dll</Path>
<Version>7.0.1506.269</Version>
<Company>AVAST Software</Company>
<Description>Antivirus HW dependent library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x73360000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\qmgrprxy.dll</Path>
<Version>7.5.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Background Intelligent Transfer Service Proxy</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x73f00000</BaseAddress>
<Size>53248</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040504\arPot.dll</Path>
<Version>7.0.1506.244</Version>
<Company>AVAST Software</Company>
<Description>ArPot usermode dll component</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\SAMCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NetApi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x754f0000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\schannel.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TLS / SSL Security Provider</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\Wtsapi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\wshtcpip.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76f10000</BaseAddress>
<Size>172032</Size>
<Path>C:\Windows\system32\imagehlp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT Image Helper</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287111</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>246</ProcessIndex>
<ProcessId>1640</ProcessId>
<ParentProcessId>468</ParentProcessId>
<ParentProcessIndex>228</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321476452323</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>conhost.exe</ProcessName>
<ImagePath>C:\Windows\system32\conhost.exe</ImagePath>
<CommandLine>\??\C:\Windows\system32\conhost.exe &quot;-1787936648-796517604-2007917410-1354616604-320319752-230837961-8151588261916011241</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Console Window Host</Description>
<modulelist>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0xaa0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\conhost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Console Window Host</Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287173</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>247</ProcessIndex>
<ProcessId>1768</ProcessId>
<ParentProcessId>1088</ParentProcessId>
<ParentProcessIndex>239</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411321559934458</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>Dwm.exe</ProcessName>
<ImagePath>C:\Windows\system32\Dwm.exe</ImagePath>
<CommandLine>&quot;C:\Windows\system32\Dwm.exe&quot;</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Desktop Window Manager</Description>
<modulelist>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x6a0000</BaseAddress>
<Size>106496</Size>
<Path>C:\Windows\system32\Dwm.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Desktop Window Manager</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x70200000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\dxgi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX Graphics Infrastructure</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x70350000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\d3d10_1.dll</Path>
<Version>6.1.7601.17544 (win7sp1_gdr.110116-1505)</Version>
<Company>Microsoft Corporation</Company>
<Description>Direct3D 10.1 Runtime</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x70380000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\d3d10_1core.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Direct3D 10.1 Runtime</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x703f0000</BaseAddress>
<Size>1380352</Size>
<Path>C:\Windows\system32\dwmcore.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft DWM Core Library</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x70550000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\dwmredir.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager Redirection Component</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287238</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>248</ProcessIndex>
<ProcessId>1724</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411321560558459</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>1</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>taskhost.exe</ProcessName>
<ImagePath>C:\Windows\system32\taskhost.exe</ImagePath>
<CommandLine>&quot;taskhost.exe&quot;</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Tasks</Description>
<modulelist>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x410000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\taskhost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Tasks</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x6e3d0000</BaseAddress>
<Size>196608</Size>
<Path>C:\Windows\system32\wdmaud.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winmm  audio system driver</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x6f670000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\midimap.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft MIDI Mapper</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x6f680000</BaseAddress>
<Size>368640</Size>
<Path>C:\Windows\System32\netprofm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x6fa80000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\msacm32.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Sound Mapper</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x70000000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\PlaySndSrv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PlaySound Service</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x70290000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\system32\MSUTB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSUTB Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x702c0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\MsCtfMonitor.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MsCtfMonitor DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x702d0000</BaseAddress>
<Size>495616</Size>
<Path>C:\Windows\System32\mscms.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Color Matching System DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x703d0000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\Dxva2.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX Video Acceleration 2.0 DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x723b0000</BaseAddress>
<Size>1409024</Size>
<Path>C:\Windows\System32\msxml6.dll</Path>
<Version>6.30.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 6.0 SP3</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x73140000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\dimsjob.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DIMS Job DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\MSACM32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\AUDIOSES.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x74160000</BaseAddress>
<Size>512000</Size>
<Path>C:\Windows\system32\taskschd.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler COM API</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x741f0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\dsrole.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DS Role Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\System32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\system32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\system32\MMDevAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287297</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>250</ProcessIndex>
<ProcessId>1716</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321696746698</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>spoolsv.exe</ProcessName>
<ImagePath>C:\Windows\System32\spoolsv.exe</ImagePath>
<CommandLine>C:\Windows\System32\spoolsv.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Spooler SubSystem App</Description>
<modulelist>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x480000</BaseAddress>
<Size>327680</Size>
<Path>C:\Windows\System32\spoolsv.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Spooler SubSystem App</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6e150000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\System32\inetpp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Print Provider DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6e180000</BaseAddress>
<Size>507904</Size>
<Path>C:\Windows\System32\win32spl.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Side Rendering Print Provider</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6e200000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\spool\PRTPROCS\W32X86\winprint.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Print Processor DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6e210000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\fdPnp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Pnp Provider Dll</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6e220000</BaseAddress>
<Size>794624</Size>
<Path>C:\Windows\System32\webservices.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Web Services Runtime</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6e2f0000</BaseAddress>
<Size>471040</Size>
<Path>C:\Windows\System32\wsdapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Services for Devices API DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6e370000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\System32\WSDMon.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WSD Printer Port Monitor</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6e3a0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wls0wndh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Session0 Viewer Window Hook DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6e3b0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\usbmon.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Standard Dynamic Printing Port Monitor DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6e3c0000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\wsnmp32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft WinSNMP v2.0 Manager API</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6f3e0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\snmpapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SNMP Utility Library</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6f3f0000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\System32\tcpmon.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Standard TCP/IP Port Monitor DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6f420000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\FXSMON.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft  Fax Print Monitor</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6f430000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\PrintIsolationProxy.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Print Sandbox COM Proxy Stub</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6f440000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\SPOOLSS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Spooler SubSystem DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x70840000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\FunDisc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Function Discovery Dll</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x70970000</BaseAddress>
<Size>782336</Size>
<Path>C:\Windows\System32\localspl.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Local Spooler DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\winspool.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x723b0000</BaseAddress>
<Size>1409024</Size>
<Path>C:\Windows\System32\msxml6.dll</Path>
<Version>6.30.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 6.0 SP3</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x727d0000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\umb.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Mode Bus Driver Interface Dll</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\System32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\System32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x741f0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\dsrole.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DS Role Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\System32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\System32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\System32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\DEVRTL.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75bd0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\System32\SPINF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SPINF</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\System32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287424</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>251</ProcessIndex>
<ProcessId>1872</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e5</AuthenticationId>
<CreateTime>130411321718742737</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\LOCAL SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x6f680000</BaseAddress>
<Size>368640</Size>
<Path>C:\Windows\System32\netprofm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x6fd00000</BaseAddress>
<Size>577536</Size>
<Path>c:\windows\system32\mpssvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Protection Service</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x70680000</BaseAddress>
<Size>151552</Size>
<Path>c:\windows\system32\dps.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WDI Diagnostic Policy Service</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x70740000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\wfapigp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall GPO Helper dll</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x70770000</BaseAddress>
<Size>516096</Size>
<Path>c:\windows\system32\bfe.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base Filtering Engine</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x70ce0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wshqos.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>QoS Winsock2 Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x71690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\pnpts.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PlugPlay Troubleshooter</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>c:\windows\system32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x73540000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\wdiasqmmodule.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Adaptive SQM WDI Plugin</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x73600000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\radardt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Resource Exhaustion Detector</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x73890000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\wdi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Diagnostic Infrastructure</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x74160000</BaseAddress>
<Size>512000</Size>
<Path>C:\Windows\system32\taskschd.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler COM API</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>c:\windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\System32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>c:\windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75860000</BaseAddress>
<Size>110592</Size>
<Path>c:\windows\system32\AUTHZ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Authorization Framework</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\wshtcpip.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\pcwum.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287488</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>252</ProcessIndex>
<ProcessId>2140</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321724982747</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>ACService.exe</ProcessName>
<ImagePath>C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe&quot;</CommandLine>
<CompanyName>ArcSoft Inc.</CompanyName>
<Version>1.1.0.47</Version>
<Description>ArcSoft Connect Service</Description>
<modulelist>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>110592</Size>
<Path>C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe</Path>
<Version>1.1.0.47</Version>
<Company>ArcSoft Inc.</Company>
<Description>ArcSoft Connect Service</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSApi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287548</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>253</ProcessIndex>
<ProcessId>2160</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321725450748</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>armsvc.exe</ProcessName>
<ImagePath>C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe&quot;</CommandLine>
<CompanyName>Adobe Systems Incorporated</CompanyName>
<Version>1.701.3.3014</Version>
<Description>Adobe Acrobat Update Service</Description>
<modulelist>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0xd0000</BaseAddress>
<Size>65536</Size>
<Path>C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe</Path>
<Version>1.701.3.3014</Version>
<Company>Adobe Systems Incorporated</Company>
<Description>Adobe Acrobat Update Service</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x72240000</BaseAddress>
<Size>667648</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll</Path>
<Version>9.00.30729.6161</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287604</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>254</ProcessIndex>
<ProcessId>2224</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321733250762</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>BCUService.exe</ProcessName>
<ImagePath>C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe&quot;</CommandLine>
<CompanyName>DeviceVM, Inc.</CompanyName>
<Version>1, 1, 7, 0</Version>
<Description>Browser Configuration Utility Auto-recovery Service</Description>
<modulelist>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>212992</Size>
<Path>C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe</Path>
<Version>1, 1, 7, 0</Version>
<Company>DeviceVM, Inc.</Company>
<Description>Browser Configuration Utility Auto-recovery Service</Description>
</module>
<module>
<Timestamp>130412104276470470</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\System32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412104276465965</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412104276486954</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412104276503246</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\System32\ntdsapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412104276498878</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\System32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287720</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>255</ProcessIndex>
<ProcessId>2332</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411321742922779</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>RaRegistry.exe</ProcessName>
<ImagePath>C:\Program Files\Ralink\Common\RaRegistry.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Ralink\Common\RaRegistry.exe&quot;</CommandLine>
<CompanyName>Ralink Technology, Corp.</CompanyName>
<Version>1, 0, 0, 26</Version>
<Description>RalinkRegistryWriter</Description>
<modulelist>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>376832</Size>
<Path>C:\Program Files\Ralink\Common\RaRegistry.exe</Path>
<Version>1, 0, 0, 26</Version>
<Company>Ralink Technology, Corp.</Company>
<Description>RalinkRegistryWriter</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>552960</Size>
<Path>C:\Program Files\Ralink\Common\ICSDHCP.dll</Path>
<Version>1, 1, 2, 14</Version>
<Company>Ralink Technology, Inc.</Company>
<Description>ICSDHCP DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\RASAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287785</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>256</ProcessIndex>
<ProcessId>2796</ProcessId>
<ParentProcessId>760</ParentProcessId>
<ParentProcessIndex>224</ParentProcessIndex>
<AuthenticationId>00000000:000003e4</AuthenticationId>
<CreateTime>130411322047435314</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\NETWORK SERVICE</Owner>
<ProcessName>wmiprvse.exe</ProcessName>
<ImagePath>C:\Windows\system32\wbem\wmiprvse.exe</ImagePath>
<CommandLine>C:\Windows\system32\wbem\wmiprvse.exe</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Description>WMI Provider Host</Description>
<modulelist>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x450000</BaseAddress>
<Size>266240</Size>
<Path>C:\Windows\system32\wbem\wmiprvse.exe</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Provider Host</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x73280000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINBRAND.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Branding Resources</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x73950000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\framedynos.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI SDK Provider Framework</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x73990000</BaseAddress>
<Size>1351680</Size>
<Path>C:\Windows\system32\wbem\cimwin32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Win32 Provider</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x73fe0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\SCHEDCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Scheduler Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x74010000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\BROWCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Browser Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x741f0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\DSROLE.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DS Role Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x74280000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\wbem\wmiutils.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x74560000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\NCObjAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\SAMCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\FastProx.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x754f0000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\schannel.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>TLS / SSL Security Provider</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75530000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\LOGONCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Logon Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287849</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>257</ProcessIndex>
<ProcessId>3068</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e5</AuthenticationId>
<CreateTime>130411322053987325</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\LOCAL SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x67440000</BaseAddress>
<Size>1257472</Size>
<Path>C:\Windows\System32\msxml3.dll</Path>
<Version>8.110.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 3.0 SP11</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x6dea0000</BaseAddress>
<Size>278528</Size>
<Path>c:\windows\system32\upnphost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>UPnP Device Host</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x6e000000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\httpapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>HTTP Protocol Stack API</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x6e080000</BaseAddress>
<Size>819200</Size>
<Path>c:\windows\system32\fntcache.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Font Cache Service</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x6fad0000</BaseAddress>
<Size>53248</Size>
<Path>c:\windows\system32\SSDPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SSDP Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x70ce0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wshqos.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>QoS Winsock2 Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x71850000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\ktmw32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows KTM Win32 Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x733d0000</BaseAddress>
<Size>172032</Size>
<Path>c:\windows\system32\ssdpsrv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SSDP Service DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>c:\windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\wshtcpip.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\pcwum.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287909</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>258</ProcessIndex>
<ProcessId>3360</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e4</AuthenticationId>
<CreateTime>130411322071303356</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\NETWORK SERVICE</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\system32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>c:\windows\system32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x73150000</BaseAddress>
<Size>57344</Size>
<Path>c:\windows\system32\FwRemoteSvr.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall Remote APIs Server</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x73160000</BaseAddress>
<Size>360448</Size>
<Path>c:\windows\system32\ipsecsvc.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows IPsec SPD Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>c:\windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x75860000</BaseAddress>
<Size>110592</Size>
<Path>c:\windows\system32\AUTHZ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Authorization Framework</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>c:\windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571287973</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>259</ProcessIndex>
<ProcessId>3544</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>221</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322087371384</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>1</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>nusb3mon.exe</ProcessName>
<ImagePath>C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe&quot; </CommandLine>
<CompanyName>Renesas Electronics Corporation</CompanyName>
<Version>2.0.28.0</Version>
<Description>USB 3.0 Monitor</Description>
<modulelist>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>114688</Size>
<Path>C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe</Path>
<Version>2.0.28.0</Version>
<Company>Renesas Electronics Corporation</Company>
<Description>USB 3.0 Monitor</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>94208</Size>
<Path>C:\Program Files\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.dll</Path>
<Version>2.0.28.0</Version>
<Company>Renesas Electronics Corporation</Company>
<Description>USB 3.0 Monitor</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288033</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>260</ProcessIndex>
<ProcessId>3552</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>221</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322087527384</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>AvastUI.exe</ProcessName>
<ImagePath>C:\Program Files\AVAST Software\Avast\AvastUI.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\AVAST Software\Avast\AvastUI.exe&quot; /nogui</CommandLine>
<CompanyName>AVAST Software</CompanyName>
<Version>8.0.1506.399</Version>
<Description>avast! Antivirus</Description>
<modulelist>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0xd0000</BaseAddress>
<Size>4853760</Size>
<Path>C:\Program Files\AVAST Software\Avast\AvastUI.exe</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Antivirus</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x6b010000</BaseAddress>
<Size>348160</Size>
<Path>C:\Windows\system32\WinSATAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows System Assessment Tool API</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x6bc40000</BaseAddress>
<Size>9719808</Size>
<Path>C:\Windows\system32\ieframe.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Browser</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x6ce60000</BaseAddress>
<Size>7716864</Size>
<Path>C:\Windows\system32\nvd3dum.dll</Path>
<Version>8.15.11.8593</Version>
<Company>NVIDIA Corporation</Company>
<Description>NVIDIA Compatible Vista WDDM D3D Driver, Version 185.93 </Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x6da20000</BaseAddress>
<Size>466944</Size>
<Path>C:\Windows\system32\DSOUND.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectSound</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x6e400000</BaseAddress>
<Size>6406144</Size>
<Path>C:\Program Files\AVAST Software\Avast\CommonRes.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Common UI resources</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x6ea20000</BaseAddress>
<Size>253952</Size>
<Path>C:\Program Files\AVAST Software\Avast\1033\UILangRes.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>UILangRes</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x6ea60000</BaseAddress>
<Size>212992</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswData.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! UI Layer library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x6eaa0000</BaseAddress>
<Size>2101248</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswAra.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>aswARA.dll</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x6ef30000</BaseAddress>
<Size>3805184</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.mfc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_4bf5400abf9d60b7\mfc90u.dll</Path>
<Version>9.00.30729.4148</Version>
<Company>Microsoft Corporation</Company>
<Description>MFCDLL Shared Library - Retail Version</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x6f670000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\midimap.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft MIDI Mapper</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x6fa80000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\msacm32.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Sound Mapper</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x6fa90000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.mfcloc_1fc8b3b9a1e18e3b_9.0.30729.4148_none_4973eb1d754a9dc9\MFC90ENU.DLL</Path>
<Version>9.00.30729.4148</Version>
<Company>Microsoft Corporation</Company>
<Description>MFC Language Specific Resources</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x701c0000</BaseAddress>
<Size>237568</Size>
<Path>C:\Windows\system32\l3codecp.acm</Path>
<Version>3, 4, 0, 0</Version>
<Company>Fraunhofer Institut Integrierte Schaltungen IIS</Company>
<Description>MPEG Audio Layer-3 Codec for MSACM</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x70200000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\dxgi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX Graphics Infrastructure</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\MSIMG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x70ac0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\OLEACC.dll</Path>
<Version>7.0.0.0 (win7sp1_gdr.110826-1504)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Accessibility Core Component</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x70bd0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\sensapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SENS Connectivity API DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x70cf0000</BaseAddress>
<Size>1191936</Size>
<Path>C:\Program Files\AVAST Software\Avast\LIBEAY32.dll</Path>
<Version>1.0.1c</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x70e20000</BaseAddress>
<Size>282624</Size>
<Path>C:\Program Files\AVAST Software\Avast\SSLEAY32.dll</Path>
<Version>1.0.1c</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x719a0000</BaseAddress>
<Size>77824</Size>
<Path>C:\Program Files\AVAST Software\Avast\avastIP.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>aswDld Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x719d0000</BaseAddress>
<Size>921600</Size>
<Path>C:\Program Files\AVAST Software\Avast\Aavm4h.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Asynchronous Virus Monitor (AAVM)</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x71ac0000</BaseAddress>
<Size>151552</Size>
<Path>C:\Program Files\AVAST Software\Avast\AavmRpch.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! AAVM Remote Procedure Call Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x71af0000</BaseAddress>
<Size>479232</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswSqLt.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! SQLite library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x71b70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswLog.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Log library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x71bc0000</BaseAddress>
<Size>163840</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashTask.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Task Handling Module</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x71bf0000</BaseAddress>
<Size>688128</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswAux.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Auxiliary Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x71ca0000</BaseAddress>
<Size>270336</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswProperty.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Property Storage library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\system32\WINHTTP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x71ee0000</BaseAddress>
<Size>1183744</Size>
<Path>C:\Program Files\AVAST Software\Avast\dbghelp.dll</Path>
<Version>6.11.0001.404 (debuggers(dbg).090225-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x72010000</BaseAddress>
<Size>57344</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswEngLdr.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Antivirus engine loader</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x720c0000</BaseAddress>
<Size>970752</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashBase.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Basic Functionality Module</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x721b0000</BaseAddress>
<Size>581632</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCP90.dll</Path>
<Version>9.00.30729.6161</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C++ Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x72240000</BaseAddress>
<Size>667648</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\MSVCR90.dll</Path>
<Version>9.00.30729.6161</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x722f0000</BaseAddress>
<Size>212992</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswCmnIS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Antivirus independent functions</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x72330000</BaseAddress>
<Size>126976</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswCmnOS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Antivirus HW dependent library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x72350000</BaseAddress>
<Size>389120</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswCmnBS.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>Common functions</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x729e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswUtil.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Utility library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x72bf0000</BaseAddress>
<Size>1015808</Size>
<Path>C:\Windows\system32\CRYPTUI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust UI Provider</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x73f10000</BaseAddress>
<Size>49152</Size>
<Path>C:\Program Files\AVAST Software\Avast\defs\14040504\uiExt.dll</Path>
<Version>7.0.1506.285</Version>
<Company>AVAST Software</Company>
<Description>avast! UI extension library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\MSACM32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\AUDIOSES.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\NLAapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\system32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x744d0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\rtutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Routing Utilities</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\RASAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\System32\MMDevApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\System32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\DEVRTL.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75bd0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\SPINF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows SPINF</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\COMDLG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288095</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>261</ProcessIndex>
<ProcessId>3768</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>221</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322097203405</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>ACDaemon.exe</ProcessName>
<ImagePath>C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe&quot; </CommandLine>
<CompanyName>ArcSoft Inc.</CompanyName>
<Version>1.1.0.49</Version>
<Description>ArcSoft Connect Daemon</Description>
<modulelist>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>212992</Size>
<Path>C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe</Path>
<Version>1.1.0.49</Version>
<Company>ArcSoft Inc.</Company>
<Description>ArcSoft Connect Daemon</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>409600</Size>
<Path>C:\Program Files\Common Files\ArcSoft\Bin\ArcCon.dll</Path>
<Version>1.1.0.49</Version>
<Company>ArcSoft Inc.</Company>
<Description>ArcSoft Connect</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x6fd90000</BaseAddress>
<Size>2359296</Size>
<Path>C:\Windows\system32\msi.dll</Path>
<Version>5.0.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Installer</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x70bd0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\sensapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SENS Connectivity API DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\iphlpapi.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x744d0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\rtutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Routing Utilities</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x744e0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Windows\system32\rasman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access Connection Manager</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x74500000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\RASAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access API</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\dnsapi.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288154</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>262</ProcessIndex>
<ProcessId>3800</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>221</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322102475413</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>jusched.exe</ProcessName>
<ImagePath>C:\Program Files\Common Files\Java\Java Update\jusched.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Common Files\Java\Java Update\jusched.exe&quot; </CommandLine>
<CompanyName>Oracle Corporation</CompanyName>
<Version>2.1.9.8</Version>
<Description>Java(TM) Update Scheduler</Description>
<modulelist>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x400000</BaseAddress>
<Size>266240</Size>
<Path>C:\Program Files\Common Files\Java\Java Update\jusched.exe</Path>
<Version>2.1.9.8</Version>
<Company>Oracle Corporation</Company>
<Description>Java(TM) Update Scheduler</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288245</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>263</ProcessIndex>
<ProcessId>4012</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>221</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322136795473</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>Plex Media Server.exe</ProcessName>
<ImagePath>C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe&quot; </CommandLine>
<CompanyName>Plex, Inc.</CompanyName>
<Version>0.9.9.7</Version>
<Description>Plex Media Server</Description>
<modulelist>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x2e0000</BaseAddress>
<Size>376832</Size>
<Path>C:\Program Files\Plex\Plex Media Server\swscale-2.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>1171456</Size>
<Path>C:\Program Files\Plex\Plex Media Server\icuuc40.dll</Path>
<Version>4, 0, 0, 0</Version>
<Company>IBM Corporation and others</Company>
<Description>IBM ICU Common DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x5c0000</BaseAddress>
<Size>1044480</Size>
<Path>C:\Program Files\Plex\Plex Media Server\cairo.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x940000</BaseAddress>
<Size>4427776</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Plex Media Server.exe</Path>
<Version>0.9.9.7</Version>
<Company>Plex, Inc.</Company>
<Description>Plex Media Server</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0xd80000</BaseAddress>
<Size>8536064</Size>
<Path>C:\Program Files\Plex\Plex Media Server\WebKit.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x15b0000</BaseAddress>
<Size>13918208</Size>
<Path>C:\Program Files\Plex\Plex Media Server\icudt40.dll</Path>
<Version>4, 0, 0, 0</Version>
<Company>IBM Corporation and others</Company>
<Description>ICU Data DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>954368</Size>
<Path>C:\Program Files\Plex\Plex Media Server\CFLite.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x66d80000</BaseAddress>
<Size>237568</Size>
<Path>C:\Program Files\Plex\Plex Media Server\avutil-52.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x68b00000</BaseAddress>
<Size>1007616</Size>
<Path>C:\Program Files\Plex\Plex Media Server\WinSparkle.dll</Path>
<Version>0.3.0</Version>
<Company>winsparkle.org</Company>
<Description>WinSparkle updater</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x68f60000</BaseAddress>
<Size>77824</Size>
<Path>C:\Program Files\Plex\Plex Media Server\zlib1.dll</Path>
<Version>1.2.7</Version>
<Company></Company>
<Description>zlib data compression library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x693b0000</BaseAddress>
<Size>1380352</Size>
<Path>C:\Program Files\Plex\Plex Media Server\JavaScriptCore.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x69510000</BaseAddress>
<Size>1310720</Size>
<Path>C:\Program Files\Plex\Plex Media Server\icuin40.dll</Path>
<Version>4, 0, 0, 0</Version>
<Company>IBM Corporation and others</Company>
<Description>IBM ICU I18N DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x69900000</BaseAddress>
<Size>1474560</Size>
<Path>C:\Program Files\Plex\Plex Media Server\avformat-54.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6a0c0000</BaseAddress>
<Size>13365248</Size>
<Path>C:\Program Files\Plex\Plex Media Server\avcodec-54.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6b280000</BaseAddress>
<Size>544768</Size>
<Path>C:\Windows\system32\MSVCP110.dll</Path>
<Version>11.00.51106.1 built by: Q11REL</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6b310000</BaseAddress>
<Size>2236416</Size>
<Path>C:\Program Files\Plex\Plex Media Server\FreeImage.dll</Path>
<Version>3, 15, 4, 0</Version>
<Company>FreeImage</Company>
<Description>FreeImage library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6b570000</BaseAddress>
<Size>45056</Size>
<Path>C:\Program Files\Plex\Plex Media Server\pthreadVC2.dll</Path>
<Version>2, 9, 0, 0</Version>
<Company>Open Source Software community project</Company>
<Description>POSIX Threads for Windows32 Library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6bc40000</BaseAddress>
<Size>9719808</Size>
<Path>C:\Windows\System32\ieframe.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Browser</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6c920000</BaseAddress>
<Size>471040</Size>
<Path>C:\Program Files\Plex\Plex Media Server\sqlite3.dll</Path>
<Version>3.8.0.2</Version>
<Company>SQLite Development Team</Company>
<Description>SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine.</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6c9a0000</BaseAddress>
<Size>913408</Size>
<Path>C:\Program Files\Plex\Plex Media Server\iconv.dll</Path>
<Version>_</Version>
<Company>Free Software Foundation</Company>
<Description>LGPLed libiconv for Windows NT/2000/XP/Vista and Windows 95/98/ME</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6cac0000</BaseAddress>
<Size>856064</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libxml2.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6cc60000</BaseAddress>
<Size>1122304</Size>
<Path>C:\Program Files\Plex\Plex Media Server\LIBEAY32.dll</Path>
<Version>1.0.0d</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6cd80000</BaseAddress>
<Size>876544</Size>
<Path>C:\Windows\system32\MSVCR110.dll</Path>
<Version>11.00.51106.1 built by: Q11REL</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6d770000</BaseAddress>
<Size>98304</Size>
<Path>C:\Program Files\Plex\Plex Media Server\soci_core-vc80-3_0.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6d790000</BaseAddress>
<Size>61440</Size>
<Path>C:\Program Files\Plex\Plex Media Server\soci_sqlite3-vc80-3_0.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6d9a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libidn.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6d9e0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Program Files\Plex\Plex Media Server\SSLEAY32.dll</Path>
<Version>1.0.0d</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6f2e0000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libcurl.dll</Path>
<Version>7.30.0</Version>
<Company>The cURL library, http://curl.haxx.se/</Company>
<Description>libcurl Shared Library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6f350000</BaseAddress>
<Size>516096</Size>
<Path>C:\Program Files\Plex\Plex Media Server\tag.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\CSCAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6f950000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\CSCDLL.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Temporary Shim</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6f960000</BaseAddress>
<Size>434176</Size>
<Path>C:\Windows\System32\cscui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Side Caching UI</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6f9d0000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\system32\EhStorShell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Enhanced Storage Shell Extension DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x6ffd0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashShell.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Shell Extension</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x70810000</BaseAddress>
<Size>77824</Size>
<Path>C:\Program Files\Plex\Plex Media Server\zlib.dll</Path>
<Version>1.2.7</Version>
<Company></Company>
<Description>zlib data compression library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\MSIMG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x70ac0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\System32\OLEACC.dll</Path>
<Version>7.0.0.0 (win7sp1_gdr.110826-1504)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Accessibility Core Component</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x70c40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\winrnr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LDAP RnR Provider DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x70c50000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\pnrpnsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PNRP Name Space Provider</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x70c70000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\napinsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>E-mail Naming Shim Provider</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\NLAapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\MSWSOCK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\system32\comdlg32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288310</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>264</ProcessIndex>
<ProcessId>3888</ProcessId>
<ParentProcessId>4012</ParentProcessId>
<ParentProcessIndex>263</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411322343413010</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>PlexDlnaServer.exe</ProcessName>
<ImagePath>C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe&quot; </CommandLine>
<CompanyName>Plex, Inc.</CompanyName>
<Version>0.9.9.7</Version>
<Description>Plex Media Server DLNA Service</Description>
<modulelist>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0xe50000</BaseAddress>
<Size>1642496</Size>
<Path>C:\Program Files\Plex\Plex Media Server\PlexDlnaServer.exe</Path>
<Version>0.9.9.7</Version>
<Company>Plex, Inc.</Company>
<Description>Plex Media Server DLNA Service</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x6b280000</BaseAddress>
<Size>544768</Size>
<Path>C:\Windows\system32\MSVCP110.dll</Path>
<Version>11.00.51106.1 built by: Q11REL</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x6c920000</BaseAddress>
<Size>471040</Size>
<Path>C:\Program Files\Plex\Plex Media Server\sqlite3.dll</Path>
<Version>3.8.0.2</Version>
<Company>SQLite Development Team</Company>
<Description>SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine.</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x6c9a0000</BaseAddress>
<Size>913408</Size>
<Path>C:\Program Files\Plex\Plex Media Server\iconv.dll</Path>
<Version>_</Version>
<Company>Free Software Foundation</Company>
<Description>LGPLed libiconv for Windows NT/2000/XP/Vista and Windows 95/98/ME</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x6cac0000</BaseAddress>
<Size>856064</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libxml2.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x6cc60000</BaseAddress>
<Size>1122304</Size>
<Path>C:\Program Files\Plex\Plex Media Server\LIBEAY32.dll</Path>
<Version>1.0.0d</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x6cd80000</BaseAddress>
<Size>876544</Size>
<Path>C:\Windows\system32\MSVCR110.dll</Path>
<Version>11.00.51106.1 built by: Q11REL</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x6d9a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libidn.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x6d9e0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Program Files\Plex\Plex Media Server\SSLEAY32.dll</Path>
<Version>1.0.0d</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x6f2e0000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libcurl.dll</Path>
<Version>7.30.0</Version>
<Company>The cURL library, http://curl.haxx.se/</Company>
<Description>libcurl Shared Library</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x70810000</BaseAddress>
<Size>77824</Size>
<Path>C:\Program Files\Plex\Plex Media Server\zlib.dll</Path>
<Version>1.2.7</Version>
<Company></Company>
<Description>zlib data compression library</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288377</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>265</ProcessIndex>
<ProcessId>744</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130411323296797540</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>svchost.exe</ProcessName>
<ImagePath>C:\Windows\System32\svchost.exe</ImagePath>
<CommandLine>C:\Windows\System32\svchost.exe -k secsvcs</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Host Process for Windows Services</Description>
<modulelist>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x340000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\svchost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host Process for Windows Services</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x65320000</BaseAddress>
<Size>7278592</Size>
<Path>C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{44225E1D-301C-465A-AC82-39D9B68EA299}\mpengine.dll</Path>
<Version>1.1.7702.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Malware Protection Engine</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x67680000</BaseAddress>
<Size>622592</Size>
<Path>C:\Windows\System32\tdh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Event Trace Helper Library</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x67720000</BaseAddress>
<Size>163840</Size>
<Path>c:\program files\windows defender\mprtp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>AntiMalware Realtime Monitor</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x679f0000</BaseAddress>
<Size>61440</Size>
<Path>C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{44225E1D-301C-465A-AC82-39D9B68EA299}\offreg.dll</Path>
<Version>6.1.7600.16385 (win7_wdk.100208-1538)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline registry DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x6df20000</BaseAddress>
<Size>692224</Size>
<Path>c:\program files\windows defender\mpsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Service Module</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x6e010000</BaseAddress>
<Size>405504</Size>
<Path>c:\program files\windows defender\MpClient.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Interface</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x707f0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\sfc_os.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x70800000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\sfc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x71830000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\wscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Security Center API</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\System32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\System32\XmlLite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76f10000</BaseAddress>
<Size>172032</Size>
<Path>C:\Windows\system32\imagehlp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT Image Helper</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288439</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>266</ProcessIndex>
<ProcessId>1600</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e4</AuthenticationId>
<CreateTime>130411323333499639</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\NETWORK SERVICE</Owner>
<ProcessName>wmpnetwk.exe</ProcessName>
<ImagePath>C:\Program Files\Windows Media Player\wmpnetwk.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Windows Media Player\wmpnetwk.exe&quot;</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Media Player Network Sharing Service</Description>
<modulelist>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x730000</BaseAddress>
<Size>1142784</Size>
<Path>C:\Program Files\Windows Media Player\wmpnetwk.exe</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Player Network Sharing Service</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x65a20000</BaseAddress>
<Size>12632064</Size>
<Path>C:\Windows\system32\wmploc.dll</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Player Resources</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x66630000</BaseAddress>
<Size>11485184</Size>
<Path>C:\Windows\system32\wmp.dll</Path>
<Version>12.0.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Player</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x67440000</BaseAddress>
<Size>1257472</Size>
<Path>C:\Windows\System32\msxml3.dll</Path>
<Version>8.110.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 3.0 SP11</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6b010000</BaseAddress>
<Size>348160</Size>
<Path>C:\Windows\system32\WinSATAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows System Assessment Tool API</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6ca80000</BaseAddress>
<Size>204800</Size>
<Path>C:\Program Files\Internet Explorer\ieproxy.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>IE ActiveX Interface Marshaling Library</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6d650000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\devenum.dll</Path>
<Version>6.6.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device enumeration.</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6d760000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\msdmo.dll</Path>
<Version>6.6.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>DMO Runtime</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6dad0000</BaseAddress>
<Size>847872</Size>
<Path>C:\Windows\System32\msmpeg2enc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft MPEG-2 Encoder</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6dba0000</BaseAddress>
<Size>753664</Size>
<Path>C:\Windows\system32\BlackBox.dll</Path>
<Version>11.0.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>BlackBox DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6dc60000</BaseAddress>
<Size>753664</Size>
<Path>C:\Windows\system32\wmpmde.dll</Path>
<Version>12.0.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMPMDE DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6dd20000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\drmv2clt.dll</Path>
<Version>11.0.7600.16385</Version>
<Company>Microsoft Corporation</Company>
<Description>DRMv2 Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6de20000</BaseAddress>
<Size>516096</Size>
<Path>C:\Windows\system32\wmdrmdev.dll</Path>
<Version>12.0.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media DRM for Network Devices Registration DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6dea0000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\upnphost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>UPnP Device Host</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6def0000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\System32\wmpps.dll</Path>
<Version>12.0.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Media Player Proxy Stub Dll</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6e000000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\HTTPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>HTTP Protocol Stack API</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6f320000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\System32\provsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HomeGroup</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6f680000</BaseAddress>
<Size>368640</Size>
<Path>C:\Windows\System32\netprofm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x6fad0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\SSDPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SSDP Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x70200000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\dxgi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX Graphics Infrastructure</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\system32\WINHTTP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x723b0000</BaseAddress>
<Size>1409024</Size>
<Path>C:\Windows\System32\msxml6.dll</Path>
<Version>6.30.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 6.0 SP3</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x729f0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\DAVHLPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DAV Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x72a00000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\davclnt.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web DAV Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x72a20000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\System32\ntlanman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Lan Manager</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x72a40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\drprov.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Remote Desktop Session Host Server Network Provider</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x72a50000</BaseAddress>
<Size>1671168</Size>
<Path>C:\Windows\system32\NetworkExplorer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Explorer</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x72fe0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\LINKINFO.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Volume Tracking</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x73490000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\upnp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>UPnP Control Point API</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x73da0000</BaseAddress>
<Size>364544</Size>
<Path>C:\Windows\system32\MFPlat.DLL</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation Platform DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\System32\nlaapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\windowscodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\XmlLite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75bb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\pcwum.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Performance Counters for Windows Native DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288501</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>267</ProcessIndex>
<ProcessId>3832</ProcessId>
<ParentProcessId>4012</ParentProcessId>
<ParentProcessIndex>263</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411325446525816</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>PlexScriptHost.exe</ProcessName>
<ImagePath>C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe&quot; &quot;C:\Users\manono\AppData\Local\Plex Media Server\Plug-ins\Framework.bundle\Contents\Resources\Versions\2\Python/bootstrap.py&quot; &quot;C:\Users\manono\AppData\Local\Plex Media Server\Plug-ins\System.bundle&quot;</CommandLine>
<CompanyName>Python Software Foundation</CompanyName>
<Version>2.7.4</Version>
<Description>Python</Description>
<modulelist>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x420000</BaseAddress>
<Size>45056</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\_socket.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x1e10000</BaseAddress>
<Size>24576</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\_hashlib.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x29e0000</BaseAddress>
<Size>118784</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\pyexpat.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x2a00000</BaseAddress>
<Size>692224</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\unicodedata.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x10000000</BaseAddress>
<Size>32768</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\_ssl.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x1d000000</BaseAddress>
<Size>40960</Size>
<Path>C:\Program Files\Plex\Plex Media Server\PlexScriptHost.exe</Path>
<Version>2.7.4</Version>
<Company>Python Software Foundation</Company>
<Description>Python</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x1d110000</BaseAddress>
<Size>20480</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\select.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x1d1a0000</BaseAddress>
<Size>86016</Size>
<Path>C:\Program Files\Plex\Plex Media Server\DLLs\_ctypes.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x1e000000</BaseAddress>
<Size>2334720</Size>
<Path>C:\Program Files\Plex\Plex Media Server\python27.dll</Path>
<Version>2.7.4</Version>
<Company>Python Software Foundation</Company>
<Description>Python Core</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x6c9a0000</BaseAddress>
<Size>913408</Size>
<Path>C:\Program Files\Plex\Plex Media Server\iconv.dll</Path>
<Version>_</Version>
<Company>Free Software Foundation</Company>
<Description>LGPLed libiconv for Windows NT/2000/XP/Vista and Windows 95/98/ME</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x6cac0000</BaseAddress>
<Size>856064</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libxml2.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x6cc60000</BaseAddress>
<Size>1122304</Size>
<Path>C:\Program Files\Plex\Plex Media Server\LIBEAY32.dll</Path>
<Version>1.0.0d</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x6cd80000</BaseAddress>
<Size>876544</Size>
<Path>C:\Windows\system32\MSVCR110.dll</Path>
<Version>11.00.51106.1 built by: Q11REL</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x6d9e0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Program Files\Plex\Plex Media Server\SSLEAY32.dll</Path>
<Version>1.0.0d</Version>
<Company>The OpenSSL Project, http://www.openssl.org/</Company>
<Description>OpenSSL Shared Library</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x70ce0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wshqos.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>QoS Winsock2 Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x73e20000</BaseAddress>
<Size>876544</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Exts\lxml\etree.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x73f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\SSL.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x73f30000</BaseAddress>
<Size>69632</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\crypto.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x73f50000</BaseAddress>
<Size>204800</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Exts\lxml\objectify.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x73f90000</BaseAddress>
<Size>176128</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libxslt.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x73fc0000</BaseAddress>
<Size>73728</Size>
<Path>C:\Program Files\Plex\Plex Media Server\libexslt.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x74740000</BaseAddress>
<Size>36864</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Exts\simplejson\_speedups.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x74750000</BaseAddress>
<Size>24576</Size>
<Path>C:\Program Files\Plex\Plex Media Server\Exts\OpenSSL\rand.pyd</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\wshtcpip.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288566</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>268</ProcessIndex>
<ProcessId>3844</ProcessId>
<ParentProcessId>560</ParentProcessId>
<ParentProcessIndex>231</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130411325455006301</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>conhost.exe</ProcessName>
<ImagePath>C:\Windows\system32\conhost.exe</ImagePath>
<CommandLine>\??\C:\Windows\system32\conhost.exe &quot;-1976565619156858560954269388938188644-2028549832-458736635-15438194331143419393</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Console Window Host</Description>
<modulelist>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0xaa0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\conhost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Console Window Host</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288655</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>269</ProcessIndex>
<ProcessId>5688</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>221</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130412077793430427</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>chrome.exe</ProcessName>
<ImagePath>C:\Program Files\Google\Chrome\Application\chrome.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Google\Chrome\Application\chrome.exe&quot; </CommandLine>
<CompanyName>Google Inc.</CompanyName>
<Version>33.0.1750.154</Version>
<Description>Google Chrome</Description>
<modulelist>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x250000</BaseAddress>
<Size>880640</Size>
<Path>C:\Program Files\Google\Chrome\Application\chrome.exe</Path>
<Version>33.0.1750.154</Version>
<Company>Google Inc.</Company>
<Description>Google Chrome</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x60040000</BaseAddress>
<Size>10002432</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\icudt.dll</Path>
<Version>4, 6, 0, 0</Version>
<Company>The ICU Project</Company>
<Description>ICU Data DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x609d0000</BaseAddress>
<Size>28459008</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\chrome.dll</Path>
<Version>33.0.1750.154</Version>
<Company>Google Inc.</Company>
<Description>Google Chrome</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x68c00000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\System32\Wpc.dll</Path>
<Version>1.0.0.1</Version>
<Company>Microsoft Corporation</Company>
<Description>WPC Settings Library</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x6a6f0000</BaseAddress>
<Size>159744</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswJsFlt.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Script Blocking filter library</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x702d0000</BaseAddress>
<Size>495616</Size>
<Path>C:\Windows\system32\mscms.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Color Matching System DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x70ac0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\OLEACC.dll</Path>
<Version>7.0.0.0 (win7sp1_gdr.110826-1504)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Accessibility Core Component</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x70be0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\cryptnet.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto Network Related API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x71e30000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\system32\webio.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web Transfer Protocols API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x71e80000</BaseAddress>
<Size>360448</Size>
<Path>C:\Windows\system32\WINHTTP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows HTTP Services</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x72fe0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\LINKINFO.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Volume Tracking</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x731f0000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\actxprxy.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ActiveX Interface Marshaling Library</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x73810000</BaseAddress>
<Size>61440</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\audioses.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\NLAapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\SAMCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x74660000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\credui.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Manager User Interface</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\system32\MMDevAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75380000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\credssp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Delegation Security Package</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75890000</BaseAddress>
<Size>270336</Size>
<Path>C:\Windows\System32\wevtapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eventing Consumption and Configuration API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75b00000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\GPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Group Policy Client API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\system32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288728</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>270</ProcessIndex>
<ProcessId>5612</ProcessId>
<ParentProcessId>5688</ParentProcessId>
<ParentProcessIndex>269</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130412077800060806</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Low</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>chrome.exe</ProcessName>
<ImagePath>C:\Program Files\Google\Chrome\Application\chrome.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Google\Chrome\Application\chrome.exe&quot; --type=gpu-process --channel=&quot;5688.0.1091212054\1806852155&quot; --disable-image-transport-surface --supports-dual-gpus=false --gpu-driver-bug-workarounds=0,1,14,27,33 --disable-accelerated-video-decode --gpu-vendor-id=0x10de --gpu-device-id=0x01d1 --gpu-driver-vendor=NVIDIA --gpu-driver-version=8.15.11.8593 --ignored=&quot; --type=renderer &quot; /prefetch:822062411</CommandLine>
<CompanyName>Google Inc.</CompanyName>
<Version>33.0.1750.154</Version>
<Description>Google Chrome</Description>
<modulelist>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x250000</BaseAddress>
<Size>880640</Size>
<Path>C:\Program Files\Google\Chrome\Application\chrome.exe</Path>
<Version>33.0.1750.154</Version>
<Company>Google Inc.</Company>
<Description>Google Chrome</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x5dd60000</BaseAddress>
<Size>3248128</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\D3DCompiler_46.dll</Path>
<Version>9.30.9200.16384</Version>
<Company>Microsoft Corporation</Company>
<Description>Direct3D HLSL Compiler</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x5e080000</BaseAddress>
<Size>33267712</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\chrome_child.dll</Path>
<Version>33.0.1750.154</Version>
<Company>Google Inc.</Company>
<Description>Google Chrome</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x60040000</BaseAddress>
<Size>10002432</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\icudt.dll</Path>
<Version>4, 6, 0, 0</Version>
<Company>The ICU Project</Company>
<Description>ICU Data DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x68a40000</BaseAddress>
<Size>733184</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\libglesv2.dll</Path>
<Version>1.2.0.2451</Version>
<Company></Company>
<Description>ANGLE libGLESv2 Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x6c890000</BaseAddress>
<Size>114688</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\libegl.dll</Path>
<Version>1.2.0.2451</Version>
<Company></Company>
<Description>ANGLE libEGL Dynamic Link Library</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x6ce60000</BaseAddress>
<Size>7716864</Size>
<Path>C:\Windows\system32\nvd3dum.dll</Path>
<Version>8.15.11.8593</Version>
<Company>NVIDIA Corporation</Company>
<Description>NVIDIA Compatible Vista WDDM D3D Driver, Version 185.93 </Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x6d7b0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\d3d8thk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Direct3D OS Thunk Layer</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x6d7c0000</BaseAddress>
<Size>1847296</Size>
<Path>C:\Windows\system32\d3d9.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Direct3D 9 Runtime</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x73810000</BaseAddress>
<Size>61440</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\system32\powrprof.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288792</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>271</ProcessIndex>
<ProcessId>4928</ProcessId>
<ParentProcessId>5688</ParentProcessId>
<ParentProcessIndex>269</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130412077808861310</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Untrusted</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>chrome.exe</ProcessName>
<ImagePath>C:\Program Files\Google\Chrome\Application\chrome.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Google\Chrome\Application\chrome.exe&quot; --type=renderer --lang=en-US --force-fieldtrials=&quot;AutocompleteDynamicTrial_2/DefaultControl_R2_Stable/BrowserPreReadExperiment/100-pct-default/ChromeSuggestions/Default/EmbeddedSearch/Group3 pct:10c stable:pp1 use_cacheable_ntp:1 espv:210 suppress_on_srp: &quot; --enable-threaded-compositing --enable-delegated-renderer --enable-deadline-scheduling --renderer-print-preview --disable-accelerated-video-decode --enable-software-compositing --channel=&quot;5688.1.415153075\1181683766&quot; /prefetch:673131151</CommandLine>
<CompanyName>Google Inc.</CompanyName>
<Version>33.0.1750.154</Version>
<Description>Google Chrome</Description>
<modulelist>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x250000</BaseAddress>
<Size>880640</Size>
<Path>C:\Program Files\Google\Chrome\Application\chrome.exe</Path>
<Version>33.0.1750.154</Version>
<Company>Google Inc.</Company>
<Description>Google Chrome</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x5d690000</BaseAddress>
<Size>2932736</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x5d960000</BaseAddress>
<Size>4173824</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\pdf.dll</Path>
<Version>1, 0, 0, 1</Version>
<Company></Company>
<Description>Chrome PDF Viewer</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x5e080000</BaseAddress>
<Size>33267712</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\chrome_child.dll</Path>
<Version>33.0.1750.154</Version>
<Company>Google Inc.</Company>
<Description>Google Chrome</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x60040000</BaseAddress>
<Size>10002432</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\icudt.dll</Path>
<Version>4, 6, 0, 0</Version>
<Company>The ICU Project</Company>
<Description>ICU Data DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x64c80000</BaseAddress>
<Size>2318336</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\libpeerconnection.dll</Path>
<Version>33.0.1750.154</Version>
<Company>Google Inc.</Company>
<Description>Google Chrome</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x683a0000</BaseAddress>
<Size>413696</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x73810000</BaseAddress>
<Size>61440</Size>
<Path>C:\Program Files\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\system32\UxTheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\WTSAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288865</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>272</ProcessIndex>
<ProcessId>5964</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>221</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130412087117413728</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>firefox.exe</ProcessName>
<ImagePath>C:\Program Files\Mozilla Firefox\firefox.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\Mozilla Firefox\firefox.exe&quot; </CommandLine>
<CompanyName>Mozilla Corporation</CompanyName>
<Version>28.0</Version>
<Description>Firefox</Description>
<modulelist>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x11e0000</BaseAddress>
<Size>278528</Size>
<Path>C:\Program Files\Mozilla Firefox\firefox.exe</Path>
<Version>28.0</Version>
<Company>Mozilla Corporation</Company>
<Description>Firefox</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x5b710000</BaseAddress>
<Size>2154496</Size>
<Path>C:\Windows\System32\msmpeg2vdec.dll</Path>
<Version>6.1.7140.0 (fbl_multimedia(bld4act).090528-1604)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft DTV-DVD Video Decoder</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x5bb90000</BaseAddress>
<Size>24518656</Size>
<Path>C:\Program Files\Mozilla Firefox\xul.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x5d300000</BaseAddress>
<Size>3678208</Size>
<Path>C:\Program Files\Mozilla Firefox\mozjs.dll</Path>
<Version></Version>
<Company></Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x625d0000</BaseAddress>
<Size>6123520</Size>
<Path>C:\Program Files\Mozilla Firefox\gkmedias.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x64f90000</BaseAddress>
<Size>987136</Size>
<Path>C:\Windows\System32\msmpeg2adec.dll</Path>
<Version>6.1.7140.0 (fbl_multimedia(bld4act).090528-1604)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft DTV-DVD Audio Decoder</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x67c30000</BaseAddress>
<Size>188416</Size>
<Path>C:\Windows\system32\mlang.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi Language Support DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x68040000</BaseAddress>
<Size>499712</Size>
<Path>C:\Windows\System32\EVR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Enhanced Video Renderer DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x680c0000</BaseAddress>
<Size>1536000</Size>
<Path>C:\Windows\system32\quartz.dll</Path>
<Version>6.6.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectShow Runtime.</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x68240000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\PhotoMetadataHandler.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Photo Metadata Handler</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x68590000</BaseAddress>
<Size>3219456</Size>
<Path>C:\Windows\system32\mf.dll</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x688e0000</BaseAddress>
<Size>405504</Size>
<Path>C:\Program Files\Mozilla Firefox\nssckbi.dll</Path>
<Version>1.96</Version>
<Company>Mozilla Foundation</Company>
<Description>NSS Builtin Trusted Root CAs</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x68950000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\System32\StructuredQuery.dll</Path>
<Version>7.00.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Structured Query</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x689b0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\System32\mfds.dll</Path>
<Version>12.0.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation Direct Show wrapper DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x68c00000</BaseAddress>
<Size>323584</Size>
<Path>C:\Windows\System32\Wpc.dll</Path>
<Version>1.0.0.1</Version>
<Company>Microsoft Corporation</Company>
<Description>WPC Settings Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\system32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x69130000</BaseAddress>
<Size>212992</Size>
<Path>C:\Windows\System32\mpg2splt.ax</Path>
<Version>6.6.7601.17528 (win7sp1_gdr.101222-1504)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectShow MPEG-2 Splitter.</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6a580000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\thumbcache.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Thumbnail Cache</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6a6f0000</BaseAddress>
<Size>159744</Size>
<Path>C:\Program Files\AVAST Software\Avast\aswJsFlt.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Script Blocking filter library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6a720000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\SearchFolder.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SearchFolder</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6bc40000</BaseAddress>
<Size>9719808</Size>
<Path>C:\Windows\system32\ieframe.DLL</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Browser</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6ca80000</BaseAddress>
<Size>204800</Size>
<Path>C:\Program Files\Internet Explorer\ieproxy.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>IE ActiveX Interface Marshaling Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6d650000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\devenum.dll</Path>
<Version>6.6.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device enumeration.</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6d6e0000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\system32\zipfldr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Compressed (zipped) Folders</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6d760000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\msdmo.dll</Path>
<Version>6.6.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>DMO Runtime</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\system32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6f940000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\cscapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Win32 API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6f950000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\CSCDLL.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Offline Files Temporary Shim</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6f960000</BaseAddress>
<Size>434176</Size>
<Path>C:\Windows\System32\cscui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Client Side Caching UI</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6f9d0000</BaseAddress>
<Size>200704</Size>
<Path>C:\Windows\system32\EhStorShell.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Enhanced Storage Shell Extension DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x6ffd0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Program Files\AVAST Software\Avast\ashShell.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! Shell Extension</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x70020000</BaseAddress>
<Size>1503232</Size>
<Path>C:\Windows\system32\explorerframe.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>ExplorerFrame</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x702d0000</BaseAddress>
<Size>495616</Size>
<Path>C:\Windows\system32\mscms.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Color Matching System DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x703d0000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\dxva2.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DirectX Video Acceleration 2.0 DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x706f0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\IconCodecService.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Converts a PNG part of the icon to a legacy bmp icon</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\MSIMG32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x70ac0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\OLEACC.dll</Path>
<Version>7.0.0.0 (win7sp1_gdr.110826-1504)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Accessibility Core Component</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x70c30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\rasadhlp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Access AutoDial Helper</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x70c40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\winrnr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>LDAP RnR Provider DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x70c50000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\pnrpnsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>PNRP Name Space Provider</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x70c70000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\napinsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>E-mail Naming Shim Provider</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x71270000</BaseAddress>
<Size>143360</Size>
<Path>C:\Windows\ehome\ehtrace.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Center Event Trace Module</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x712a0000</BaseAddress>
<Size>1089536</Size>
<Path>C:\Windows\system32\dwrite.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft DirectX Typography Services</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x713b0000</BaseAddress>
<Size>1810432</Size>
<Path>C:\Program Files\Mozilla Firefox\nss3.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x71570000</BaseAddress>
<Size>778240</Size>
<Path>C:\Program Files\Mozilla Firefox\MSVCR100.dll</Path>
<Version>10.00.30319.1</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x716a0000</BaseAddress>
<Size>208896</Size>
<Path>C:\Windows\system32\mfreadwrite.dll</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation ReadWrite DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x71730000</BaseAddress>
<Size>159744</Size>
<Path>C:\Program Files\Mozilla Firefox\softokn3.dll</Path>
<Version>3.15.5 Basic ECC</Version>
<Company>Mozilla Foundation</Company>
<Description>NSS PKCS #11 Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x71790000</BaseAddress>
<Size>430080</Size>
<Path>C:\Program Files\Mozilla Firefox\MSVCP100.dll</Path>
<Version>10.00.30319.1</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x71800000</BaseAddress>
<Size>147456</Size>
<Path>C:\Program Files\Mozilla Firefox\mozglue.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x720b0000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WSOCK32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x723b0000</BaseAddress>
<Size>1409024</Size>
<Path>C:\Windows\System32\msxml6.dll</Path>
<Version>6.30.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 6.0 SP3</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x72880000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\dhcpcsvc.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCP Client Service</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x728a0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\dhcpcsvc6.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DHCPv6 Client</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x728c0000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\System32\fwpuclnt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>FWP/IPsec User-Mode API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x72990000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\WINNSI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Store Information RPC interface</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x729b0000</BaseAddress>
<Size>114688</Size>
<Path>C:\Windows\system32\IPHLPAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>IP Helper API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x729f0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\DAVHLPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DAV Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x72a00000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\davclnt.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Web DAV Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x72a20000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\System32\ntlanman.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Lan Manager</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x72a40000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\drprov.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Remote Desktop Session Host Server Network Provider</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x72a50000</BaseAddress>
<Size>1671168</Size>
<Path>C:\Windows\system32\NetworkExplorer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Explorer</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x72eb0000</BaseAddress>
<Size>360448</Size>
<Path>C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Tablet PC Input Panel Text Services Framework</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x72f10000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\system32\msls31.dll</Path>
<Version>3.10.349.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Line Services library file</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x72fe0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\LINKINFO.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Volume Tracking</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x731c0000</BaseAddress>
<Size>188416</Size>
<Path>C:\Windows\system32\SHDOCVW.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Doc Object and Control Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x731f0000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\actxprxy.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ActiveX Interface Marshaling Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x73520000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\npmproxy.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network List Manager Proxy</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x73550000</BaseAddress>
<Size>561152</Size>
<Path>C:\Windows\system32\PortableDeviceApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Portable Device API Components</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x73620000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\dtsh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Detection and Sharing Status API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x73740000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\NetworkItemFactory.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NetworkItem Factory</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x73790000</BaseAddress>
<Size>98304</Size>
<Path>C:\Program Files\Mozilla Firefox\nssdbm3.dll</Path>
<Version>3.15.5 Basic ECC</Version>
<Company>Mozilla Foundation</Company>
<Description>Legacy Database Driver</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x737b0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Program Files\Mozilla Firefox\mozalloc.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x737c0000</BaseAddress>
<Size>139264</Size>
<Path>C:\Windows\system32\EhStorAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Enhanced Storage API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x73da0000</BaseAddress>
<Size>364544</Size>
<Path>C:\Windows\system32\mfplat.dll</Path>
<Version>12.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Media Foundation Platform DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x73e10000</BaseAddress>
<Size>53248</Size>
<Path>C:\Program Files\Mozilla Firefox\browser\components\browsercomps.dll</Path>
<Version>28.0</Version>
<Company>Mozilla Foundation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\system32\AUDIOSES.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x741e0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\slc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Software Licensing Client Dll</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74260000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\NLAapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Network Location Awareness 2</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\system32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\SAMCLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74810000</BaseAddress>
<Size>1028096</Size>
<Path>C:\Windows\system32\WindowsCodecs.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Codecs Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\xmllite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\System32\MMDevApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74ab0000</BaseAddress>
<Size>208896</Size>
<Path>C:\Windows\System32\sqmapi.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>SQM Client</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74af0000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\DUser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUser Engine</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74b20000</BaseAddress>
<Size>729088</Size>
<Path>C:\Windows\system32\DUI70.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUI Engine</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\propsys.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\system32\NTDSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\system32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x752d0000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\system32\FirewallAPI.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Firewall API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\AVRT.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75560000</BaseAddress>
<Size>278528</Size>
<Path>C:\Windows\system32\DNSAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DNS Client API DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75690000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wship6.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv6)</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x756a0000</BaseAddress>
<Size>245760</Size>
<Path>C:\Windows\system32\mswsock.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Windows Sockets 2.0 Service Provider</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75890000</BaseAddress>
<Size>270336</Size>
<Path>C:\Windows\System32\wevtapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Eventing Consumption and Configuration API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75a20000</BaseAddress>
<Size>151552</Size>
<Path>C:\Windows\System32\POWRPROF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Power Profile Helper DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75a60000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\wshtcpip.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winsock2 Helper DLL (TL/IPv4)</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\WINSTA.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\Secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\system32\WINTRUST.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\system32\CRYPT32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\system32\WS2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76740000</BaseAddress>
<Size>503808</Size>
<Path>C:\Windows\System32\comdlg32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Common Dialogs DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\system32\PSAPI.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\system32\NSI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288930</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>273</ProcessIndex>
<ProcessId>2384</ProcessId>
<ParentProcessId>600</ParentProcessId>
<ParentProcessIndex>218</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130412096639658370</CreateTime>
<FinishTime>130412104155434417</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>msiexec.exe</ProcessName>
<ImagePath>C:\Windows\system32\msiexec.exe</ImagePath>
<CommandLine>C:\Windows\system32\msiexec.exe /V</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>5.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows® installer</Description>
<modulelist>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x210000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\msiexec.exe</Path>
<Version>5.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows® installer</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x5b970000</BaseAddress>
<Size>2195456</Size>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Compatibility DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x64bf0000</BaseAddress>
<Size>577536</Size>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Compatibility DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x67440000</BaseAddress>
<Size>1257472</Size>
<Path>C:\Windows\System32\msxml3.dll</Path>
<Version>8.110.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>MSXML 3.0 SP11</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x6b590000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\vss_ps.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Service proxy/stub</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x6d670000</BaseAddress>
<Size>196608</Size>
<Path>C:\Windows\system32\SPP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Windows Shared Protection Point Library</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x6f660000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\system32\msiltcfg.dll</Path>
<Version>5.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Installer Configuration API Stub</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x6f7b0000</BaseAddress>
<Size>1138688</Size>
<Path>C:\Windows\system32\VSSAPI.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Requestor/Writer Services API DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x6fd90000</BaseAddress>
<Size>2359296</Size>
<Path>C:\Windows\system32\msi.dll</Path>
<Version>5.0.7601.17514</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Installer</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\MPR.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x706b0000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\system32\VssTrace.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Volume Shadow Copy Service Tracing Library</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x707f0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\sfc_os.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x70800000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\sfc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\system32\WINSPOOL.DRV</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x72fe0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\LINKINFO.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Volume Tracking</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x73400000</BaseAddress>
<Size>163840</Size>
<Path>C:\Windows\system32\RSTRTMGR.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Restart Manager</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x73460000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\system32\SRCLIENT.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® Windows System Restore Client Library</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\MSACM32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x740d0000</BaseAddress>
<Size>290816</Size>
<Path>C:\Windows\System32\ES.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x741f0000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\dsrole.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>DS Role Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x74200000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\system32\ATL.DLL</Path>
<Version>3.05.2284</Version>
<Company>Microsoft Corporation</Company>
<Description>ATL Module for Windows XP (Unicode)</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\system32\WINMM.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\system32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x74610000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\system32\wkscli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Workstation Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x74620000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\netutils.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API Helpers DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x74630000</BaseAddress>
<Size>69632</Size>
<Path>C:\Windows\system32\NETAPI32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Net Win32 API DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\system32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\system32\PROPSYS.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\COMCTL32.DLL</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\system32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75820000</BaseAddress>
<Size>229376</Size>
<Path>C:\Windows\system32\ncrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows cryptographic library</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75920000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\SAMLIB.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SAM Library DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\system32\VERSION.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\system32\USERENV.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75bc0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\DEVRTL.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Management Run Time Library</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75d30000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\system32\srvcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Server Service Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75e40000</BaseAddress>
<Size>389120</Size>
<Path>C:\Windows\system32\SXS.DLL</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Fusion 2.5</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\system32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\MSASN1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\system32\CFGMGR32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\system32\DEVOBJ.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\system32\SETUPAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\system32\Normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\system32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\system32\WININET.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\system32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\system32\SHELL32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571288992</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\system32\WLDAP32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>274</ProcessIndex>
<ProcessId>4468</ProcessId>
<ParentProcessId>1136</ParentProcessId>
<ParentProcessIndex>240</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130412103000002160</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>taskeng.exe</ProcessName>
<ImagePath>C:\Windows\system32\taskeng.exe</ImagePath>
<CommandLine>taskeng.exe {FD8B98DE-4AA2-4553-985A-C711556C12FC}</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Task Scheduler Engine</Description>
<modulelist>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0xa30000</BaseAddress>
<Size>196608</Size>
<Path>C:\Windows\system32\taskeng.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler Engine</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x737f0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\system32\tschannel.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Task Scheduler Proxy</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\system32\XmlLite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\system32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\system32\CRYPTSP.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\system32\SspiCli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\system32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\system32\CRYPTBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\system32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\system32\KERNELBASE.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\system32\OLEAUT32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\system32\KERNEL32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\system32\USP10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\system32\LPK.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\system32\CLBCatQ.DLL</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\system32\GDI32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\system32\IMM32.DLL</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\SYSTEM32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\system32\SHLWAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\system32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\system32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\system32\MSCTF.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\system32\USER32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\system32\RPCRT4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\SYSTEM32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103571289054</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\system32\ADVAPI32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>275</ProcessIndex>
<ProcessId>4260</ProcessId>
<ParentProcessId>1056</ParentProcessId>
<ParentProcessIndex>238</ParentProcessIndex>
<AuthenticationId>00000000:000003e5</AuthenticationId>
<CreateTime>130412103317380313</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\LOCAL SERVICE</Owner>
<ProcessName>AUDIODG.EXE</ProcessName>
<ImagePath>C:\Windows\system32\AUDIODG.EXE</ImagePath>
<CommandLine>C:\Windows\system32\AUDIODG.EXE 0x794</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Audio Device Graph Isolation </Description>
<modulelist>
</modulelist>
</process>
<process>
<ProcessIndex>276</ProcessIndex>
<ProcessId>4860</ProcessId>
<ParentProcessId>760</ParentProcessId>
<ParentProcessIndex>224</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130412103581471176</CreateTime>
<FinishTime>0</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>wmiprvse.exe</ProcessName>
<ImagePath>C:\Windows\system32\wbem\wmiprvse.exe</ImagePath>
<CommandLine>C:\Windows\system32\wbem\wmiprvse.exe -Embedding</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Description>WMI Provider Host</Description>
<modulelist>
<module>
<Timestamp>130412103581476170</Timestamp>
<BaseAddress>0x450000</BaseAddress>
<Size>266240</Size>
<Path>C:\Windows\System32\wbem\WmiPrvSE.exe</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Provider Host</Description>
</module>
<module>
<Timestamp>130412103582391204</Timestamp>
<BaseAddress>0x6a3f0000</BaseAddress>
<Size>163840</Size>
<Path>C:\Windows\System32\wbem\wmiprov.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103582138412</Timestamp>
<BaseAddress>0x6f750000</BaseAddress>
<Size>376832</Size>
<Path>C:\Windows\System32\wbemcomn.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103582231272</Timestamp>
<BaseAddress>0x6fac0000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\wbem\wbemprox.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103582111193</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103582359648</Timestamp>
<BaseAddress>0x74280000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\wbem\wmiutils.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103582209682</Timestamp>
<BaseAddress>0x744a0000</BaseAddress>
<Size>135168</Size>
<Path>C:\Windows\System32\ntmarta.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT MARTA provider</Description>
</module>
<module>
<Timestamp>130412103582156604</Timestamp>
<BaseAddress>0x74560000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\ncobjapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103582316336</Timestamp>
<BaseAddress>0x74650000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\wbem\wbemsvc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI</Description>
</module>
<module>
<Timestamp>130412103582151554</Timestamp>
<BaseAddress>0x75010000</BaseAddress>
<Size>98304</Size>
<Path>C:\Windows\System32\ntdsapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Active Directory Domain Services API</Description>
</module>
<module>
<Timestamp>130412103582147108</Timestamp>
<BaseAddress>0x75030000</BaseAddress>
<Size>614400</Size>
<Path>C:\Windows\System32\wbem\fastprox.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>WMI Custom Marshaller</Description>
</module>
<module>
<Timestamp>130412103582295226</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103582241213</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\cryptsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103582202859</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103582302488</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103582113734</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103582139425</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103582112376</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103582133715</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\System32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103582132767</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103582225177</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\System32\clbcatq.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103582131600</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103582171563</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\System32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103582125192</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\System32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103582142390</Timestamp>
<BaseAddress>0x76700000</BaseAddress>
<Size>217088</Size>
<Path>C:\Windows\System32\ws2_32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Socket 2.0 32-Bit DLL</Description>
</module>
<module>
<Timestamp>130412103582121091</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103582140094</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\System32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103582143565</Timestamp>
<BaseAddress>0x76e30000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\nsi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NSI User-mode interface DLL</Description>
</module>
<module>
<Timestamp>130412103582172878</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\System32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103582129757</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\System32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103582127644</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103581478342</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103582210984</Timestamp>
<BaseAddress>0x77ef0000</BaseAddress>
<Size>282624</Size>
<Path>C:\Windows\System32\Wldap32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Win32 LDAP API DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>277</ProcessIndex>
<ProcessId>6092</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>221</ParentProcessIndex>
<AuthenticationId>00000000:00021a4f</AuthenticationId>
<CreateTime>130412103613401038</CreateTime>
<FinishTime>130412103613602433</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>Medium</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>MKV2AC3.exe</ProcessName>
<ImagePath>C:\Program Files\MKV2AC3\MKV2AC3.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\MKV2AC3\MKV2AC3.exe&quot; </CommandLine>
<CompanyName></CompanyName>
<Version>0.0.0.0</Version>
<Description> </Description>
<modulelist>
<module>
<Timestamp>130412103613451450</Timestamp>
<BaseAddress>0x1180000</BaseAddress>
<Size>499712</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130412103613453350</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>278</ProcessIndex>
<ProcessId>2312</ProcessId>
<ParentProcessId>1136</ParentProcessId>
<ParentProcessIndex>240</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130412103613681016</CreateTime>
<FinishTime>130412103633042549</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>consent.exe</ProcessName>
<ImagePath>C:\Windows\system32\consent.exe</ImagePath>
<CommandLine>consent.exe 1136 294 06895138</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Consent UI for administrative applications</Description>
<modulelist>
<module>
<Timestamp>130412103614023132</Timestamp>
<BaseAddress>0x4a0000</BaseAddress>
<Size>499712</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130412103613684821</Timestamp>
<BaseAddress>0x6b0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\consent.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Consent UI for administrative applications</Description>
</module>
<module>
<Timestamp>130412103632374103</Timestamp>
<BaseAddress>0x1b70000</BaseAddress>
<Size>499712</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130412103614603358</Timestamp>
<BaseAddress>0x632c0000</BaseAddress>
<Size>20275200</Size>
<Path>C:\Windows\System32\imageres.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Resource</Description>
</module>
<module>
<Timestamp>130412103614532285</Timestamp>
<BaseAddress>0x6e3d0000</BaseAddress>
<Size>196608</Size>
<Path>C:\Windows\System32\wdmaud.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winmm  audio system driver</Description>
</module>
<module>
<Timestamp>130412103614810625</Timestamp>
<BaseAddress>0x6f670000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\System32\midimap.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft MIDI Mapper</Description>
</module>
<module>
<Timestamp>130412103614794120</Timestamp>
<BaseAddress>0x6fa80000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\msacm32.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Sound Mapper</Description>
</module>
<module>
<Timestamp>130412103613756732</Timestamp>
<BaseAddress>0x70290000</BaseAddress>
<Size>180224</Size>
<Path>C:\Windows\System32\msutb.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSUTB Server DLL</Description>
</module>
<module>
<Timestamp>130412103613750359</Timestamp>
<BaseAddress>0x702c0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\MsCtfMonitor.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MsCtfMonitor DLL</Description>
</module>
<module>
<Timestamp>130412103613722151</Timestamp>
<BaseAddress>0x70a50000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\msimg32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDIEXT Client DLL</Description>
</module>
<module>
<Timestamp>130412103613694215</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103614501694</Timestamp>
<BaseAddress>0x72bf0000</BaseAddress>
<Size>1015808</Size>
<Path>C:\Windows\System32\cryptui.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust UI Provider</Description>
</module>
<module>
<Timestamp>130412103614495658</Timestamp>
<BaseAddress>0x72cf0000</BaseAddress>
<Size>1798144</Size>
<Path>C:\Windows\System32\authui.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Authentication UI</Description>
</module>
<module>
<Timestamp>130412103614798030</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130412103614620884</Timestamp>
<BaseAddress>0x74090000</BaseAddress>
<Size>221184</Size>
<Path>C:\Windows\System32\AudioSes.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Audio Session</Description>
</module>
<module>
<Timestamp>130412103613732957</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\System32\winmm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103614536284</Timestamp>
<BaseAddress>0x74410000</BaseAddress>
<Size>16384</Size>
<Path>C:\Windows\System32\ksuser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User CSA Library</Description>
</module>
<module>
<Timestamp>130412103614482387</Timestamp>
<BaseAddress>0x74660000</BaseAddress>
<Size>176128</Size>
<Path>C:\Windows\System32\credui.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Credential Manager User Interface</Description>
</module>
<module>
<Timestamp>130412103614592973</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\System32\xmllite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130412103614581356</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103614515826</Timestamp>
<BaseAddress>0x74a70000</BaseAddress>
<Size>233472</Size>
<Path>C:\Windows\System32\MMDevAPI.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MMDevice API</Description>
</module>
<module>
<Timestamp>130412103614567906</Timestamp>
<BaseAddress>0x74af0000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\System32\duser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUser Engine</Description>
</module>
<module>
<Timestamp>130412103614548149</Timestamp>
<BaseAddress>0x74b20000</BaseAddress>
<Size>729088</Size>
<Path>C:\Windows\System32\dui70.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUI Engine</Description>
</module>
<module>
<Timestamp>130412103614527615</Timestamp>
<BaseAddress>0x74be0000</BaseAddress>
<Size>1638400</Size>
<Path>C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\GdiPlus.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft GDI+</Description>
</module>
<module>
<Timestamp>130412103614520336</Timestamp>
<BaseAddress>0x74d70000</BaseAddress>
<Size>1003520</Size>
<Path>C:\Windows\System32\propsys.dll</Path>
<Version>7.00.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Property System</Description>
</module>
<module>
<Timestamp>130412103613762976</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103613973676</Timestamp>
<BaseAddress>0x753c0000</BaseAddress>
<Size>249856</Size>
<Path>C:\Windows\System32\bcryptprimitives.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103614540164</Timestamp>
<BaseAddress>0x75460000</BaseAddress>
<Size>28672</Size>
<Path>C:\Windows\System32\avrt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multimedia Realtime Runtime</Description>
</module>
<module>
<Timestamp>130412103613895812</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103613843416</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\cryptsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103613967785</Timestamp>
<BaseAddress>0x75800000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\bcrypt.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Cryptographic Primitives Library</Description>
</module>
<module>
<Timestamp>130412103614586594</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103614019863</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\version.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103613729254</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\wtsapi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103613736794</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\userenv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103613725662</Timestamp>
<BaseAddress>0x75b90000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\wmsgapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>WinLogon IPC Client</Description>
</module>
<module>
<Timestamp>130412103613744574</Timestamp>
<BaseAddress>0x75bf0000</BaseAddress>
<Size>167936</Size>
<Path>C:\Windows\System32\winsta.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Winstation Library</Description>
</module>
<module>
<Timestamp>130412103613784630</Timestamp>
<BaseAddress>0x75da0000</BaseAddress>
<Size>32768</Size>
<Path>C:\Windows\System32\secur32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103613788546</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103613825978</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103613740755</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103613747004</Timestamp>
<BaseAddress>0x75f20000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\msasn1.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>ASN.1 Runtime APIs</Description>
</module>
<module>
<Timestamp>130412103614554877</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103614556225</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\System32\devobj.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103613836404</Timestamp>
<BaseAddress>0x75f80000</BaseAddress>
<Size>184320</Size>
<Path>C:\Windows\System32\wintrust.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Trust Verification APIs</Description>
</module>
<module>
<Timestamp>130412103613745840</Timestamp>
<BaseAddress>0x75fb0000</BaseAddress>
<Size>1167360</Size>
<Path>C:\Windows\System32\crypt32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Crypto API32</Description>
</module>
<module>
<Timestamp>130412103613696543</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103614025789</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103614553659</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103613695376</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103613717031</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\System32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103613716115</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103614024762</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\System32\clbcatq.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103614037058</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103613713048</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103613752819</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\System32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103613708330</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\System32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103613764355</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103613704304</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103614032644</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\System32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103614035635</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\System32\wininet.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103614034369</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103613718063</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\System32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103613751445</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\System32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103613915955</Timestamp>
<BaseAddress>0x76f10000</BaseAddress>
<Size>172032</Size>
<Path>C:\Windows\System32\imagehlp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT Image Helper</Description>
</module>
<module>
<Timestamp>130412103613714034</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\System32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103613710863</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103613800303</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\System32\shell32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103613686942</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103613703533</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>279</ProcessIndex>
<ProcessId>1012</ProcessId>
<ParentProcessId>760</ParentProcessId>
<ParentProcessIndex>224</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130412103632391082</CreateTime>
<FinishTime>130412103682628209</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>DllHost.exe</ProcessName>
<ImagePath>C:\Windows\system32\DllHost.exe</ImagePath>
<CommandLine>C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>COM Surrogate</Description>
<modulelist>
<module>
<Timestamp>130412103632399290</Timestamp>
<BaseAddress>0x230000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\dllhost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM Surrogate</Description>
</module>
<module>
<Timestamp>130412103632571550</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103632407771</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103632598883</Timestamp>
<BaseAddress>0x73370000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\IDStore.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Identity Store</Description>
</module>
<module>
<Timestamp>130412103632565746</Timestamp>
<BaseAddress>0x73380000</BaseAddress>
<Size>122880</Size>
<Path>C:\Windows\System32\shacct.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Accounts Classes</Description>
</module>
<module>
<Timestamp>130412103632539421</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103632487176</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\cryptsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103632582730</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\userenv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103632461169</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103632547729</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103632587500</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103632410102</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103632471455</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103632408886</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103632423675</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\System32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103632422548</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103632463635</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\System32\clbcatq.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103632419455</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103632438892</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\System32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103632468122</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\System32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103632575991</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103632417237</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103632418420</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\System32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103632440266</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\System32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103632420506</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\System32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103632425251</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103632401519</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103632464629</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>280</ProcessIndex>
<ProcessId>5124</ProcessId>
<ParentProcessId>760</ParentProcessId>
<ParentProcessIndex>224</ParentProcessIndex>
<AuthenticationId>00000000:000003e7</AuthenticationId>
<CreateTime>130412103633071606</CreateTime>
<FinishTime>130412103683324602</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>System</Integrity>
<Owner>NT AUTHORITY\SYSTEM</Owner>
<ProcessName>DllHost.exe</ProcessName>
<ImagePath>C:\Windows\system32\DllHost.exe</ImagePath>
<CommandLine>C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>COM Surrogate</Description>
<modulelist>
<module>
<Timestamp>130412103633080620</Timestamp>
<BaseAddress>0x230000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\dllhost.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM Surrogate</Description>
</module>
<module>
<Timestamp>130412103633268043</Timestamp>
<BaseAddress>0x70b00000</BaseAddress>
<Size>540672</Size>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103633092371</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103633295378</Timestamp>
<BaseAddress>0x73370000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\IDStore.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Identity Store</Description>
</module>
<module>
<Timestamp>130412103633262058</Timestamp>
<BaseAddress>0x73380000</BaseAddress>
<Size>122880</Size>
<Path>C:\Windows\System32\shacct.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Accounts Classes</Description>
</module>
<module>
<Timestamp>130412103633234353</Timestamp>
<BaseAddress>0x75480000</BaseAddress>
<Size>241664</Size>
<Path>C:\Windows\System32\rsaenh.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Enhanced Cryptographic Provider</Description>
</module>
<module>
<Timestamp>130412103633181057</Timestamp>
<BaseAddress>0x756e0000</BaseAddress>
<Size>90112</Size>
<Path>C:\Windows\System32\cryptsp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Cryptographic Service Provider API</Description>
</module>
<module>
<Timestamp>130412103633279843</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\userenv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103633151811</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103633243240</Timestamp>
<BaseAddress>0x75ea0000</BaseAddress>
<Size>57344</Size>
<Path>C:\Windows\System32\RpcRtRemote.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote RPC Extension</Description>
</module>
<module>
<Timestamp>130412103633284133</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103633095422</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103633162437</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103633093975</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103633110496</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\System32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103633109219</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103633154385</Timestamp>
<BaseAddress>0x76570000</BaseAddress>
<Size>536576</Size>
<Path>C:\Windows\System32\clbcatq.dll</Path>
<Version>2001.12.8530.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>COM+ Configuration Catalog</Description>
</module>
<module>
<Timestamp>130412103633105403</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103633132240</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\System32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103633158987</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\System32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103633272704</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103633102883</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103633104298</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\System32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103633133633</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\System32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103633106699</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\System32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103633112315</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103633083366</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103633155366</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>281</ProcessIndex>
<ProcessId>1164</ProcessId>
<ParentProcessId>1772</ParentProcessId>
<ParentProcessIndex>221</ParentProcessIndex>
<AuthenticationId>00000000:00021a24</AuthenticationId>
<CreateTime>130412103633318366</CreateTime>
<FinishTime>130412103980647938</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>High</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>MKV2AC3.exe</ProcessName>
<ImagePath>C:\Program Files\MKV2AC3\MKV2AC3.exe</ImagePath>
<CommandLine>&quot;C:\Program Files\MKV2AC3\MKV2AC3.exe&quot; </CommandLine>
<CompanyName></CompanyName>
<Version>0.0.0.0</Version>
<Description> </Description>
<modulelist>
<module>
<Timestamp>130412103633786304</Timestamp>
<BaseAddress>0x3c0000</BaseAddress>
<Size>499712</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130412103634854039</Timestamp>
<BaseAddress>0xe50000</BaseAddress>
<Size>372736</Size>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Problem Reporting</Description>
</module>
<module>
<Timestamp>130412103633409922</Timestamp>
<BaseAddress>0x1090000</BaseAddress>
<Size>499712</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130412103634726000</Timestamp>
<BaseAddress>0x58b70000</BaseAddress>
<Size>1748992</Size>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Version>10.0.30319.1 built by: RTMRel</Version>
<Company>Microsoft Corporation</Company>
<Description>Visual Basic Runtime Library</Description>
</module>
<module>
<Timestamp>130412103634618907</Timestamp>
<BaseAddress>0x58d20000</BaseAddress>
<Size>7077888</Size>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Version>4.0.30319.233 built by: RTMGDR</Version>
<Company>Microsoft Corporation</Company>
<Description>.NET Framework</Description>
</module>
<module>
<Timestamp>130412103634528623</Timestamp>
<BaseAddress>0x593e0000</BaseAddress>
<Size>9097216</Size>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Version>4.0.30319.236 built by: RTMGDR</Version>
<Company>Microsoft Corporation</Company>
<Description>.NET Framework</Description>
</module>
<module>
<Timestamp>130412103634203362</Timestamp>
<BaseAddress>0x59c90000</BaseAddress>
<Size>14422016</Size>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Version>4.0.30319.239 (RTMGDR.030319-2300)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Common Language Runtime Class Library</Description>
</module>
<module>
<Timestamp>130412103634070295</Timestamp>
<BaseAddress>0x5aa60000</BaseAddress>
<Size>6742016</Size>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Version>4.0.30319.239 (RTMGDR.030319-2300)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Runtime Common Language Runtime - WorkStation</Description>
</module>
<module>
<Timestamp>130412103633767853</Timestamp>
<BaseAddress>0x5b0d0000</BaseAddress>
<Size>2461696</Size>
<Path>C:\Windows\AppPatch\AcXtrnal.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Compatibility DLL</Description>
</module>
<module>
<Timestamp>130412103633695271</Timestamp>
<BaseAddress>0x5b970000</BaseAddress>
<Size>2195456</Size>
<Path>C:\Windows\AppPatch\AcGenral.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Compatibility DLL</Description>
</module>
<module>
<Timestamp>130412103633618943</Timestamp>
<BaseAddress>0x64bf0000</BaseAddress>
<Size>577536</Size>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Compatibility DLL</Description>
</module>
<module>
<Timestamp>130412103634075495</Timestamp>
<BaseAddress>0x64ed0000</BaseAddress>
<Size>778240</Size>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Version>10.00.30319.1</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft® C Runtime Library</Description>
</module>
<module>
<Timestamp>130412103633890977</Timestamp>
<BaseAddress>0x69070000</BaseAddress>
<Size>421888</Size>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Version>4.0.30319.237 (RTMGDR.030319-2300)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Runtime Execution Engine</Description>
</module>
<module>
<Timestamp>130412103633581414</Timestamp>
<BaseAddress>0x690e0000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Version>4.0.40305.0 (Main.040305-0000)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET Runtime Execution Engine</Description>
</module>
<module>
<Timestamp>130412103633659286</Timestamp>
<BaseAddress>0x70570000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\System32\mpr.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multiple Provider Router DLL</Description>
</module>
<module>
<Timestamp>130412103633738279</Timestamp>
<BaseAddress>0x707f0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\sfc_os.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130412103633733878</Timestamp>
<BaseAddress>0x70800000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\System32\sfc.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows File Protection</Description>
</module>
<module>
<Timestamp>130412103633653861</Timestamp>
<BaseAddress>0x70a60000</BaseAddress>
<Size>331776</Size>
<Path>C:\Windows\System32\winspool.drv</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Spooler Driver</Description>
</module>
<module>
<Timestamp>130412103633573871</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103634386134</Timestamp>
<BaseAddress>0x71760000</BaseAddress>
<Size>65536</Size>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Version>4.0.30319.239 (RTMGDR.030319-2300)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Collation Support</Description>
</module>
<module>
<Timestamp>130412103633794741</Timestamp>
<BaseAddress>0x71780000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\shunimpl.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Obsolete APIs</Description>
</module>
<module>
<Timestamp>130412103633969008</Timestamp>
<BaseAddress>0x728b0000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Sort Version Server 2003</Description>
</module>
<module>
<Timestamp>130412103633721787</Timestamp>
<BaseAddress>0x73ff0000</BaseAddress>
<Size>81920</Size>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft ACM Audio Filter</Description>
</module>
<module>
<Timestamp>130412103633711679</Timestamp>
<BaseAddress>0x742a0000</BaseAddress>
<Size>204800</Size>
<Path>C:\Windows\System32\winmm.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MCI API DLL</Description>
</module>
<module>
<Timestamp>130412103633717023</Timestamp>
<BaseAddress>0x74600000</BaseAddress>
<Size>61440</Size>
<Path>C:\Windows\System32\samcli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Accounts Manager Client DLL</Description>
</module>
<module>
<Timestamp>130412103633744072</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103633706228</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103633728494</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\version.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103633643805</Timestamp>
<BaseAddress>0x75b20000</BaseAddress>
<Size>94208</Size>
<Path>C:\Windows\System32\userenv.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Userenv</Description>
</module>
<module>
<Timestamp>130412103633624130</Timestamp>
<BaseAddress>0x75dc0000</BaseAddress>
<Size>110592</Size>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Security Support Provider Interface</Description>
</module>
<module>
<Timestamp>130412103633593319</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103634305654</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103633648787</Timestamp>
<BaseAddress>0x75eb0000</BaseAddress>
<Size>45056</Size>
<Path>C:\Windows\System32\profapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Profile Basic API</Description>
</module>
<module>
<Timestamp>130412103633746875</Timestamp>
<BaseAddress>0x75f30000</BaseAddress>
<Size>159744</Size>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Configuration Manager DLL</Description>
</module>
<module>
<Timestamp>130412103633748341</Timestamp>
<BaseAddress>0x75f60000</BaseAddress>
<Size>73728</Size>
<Path>C:\Windows\System32\devobj.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Device Information Set DLL</Description>
</module>
<module>
<Timestamp>130412103633576908</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103633638992</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103633745616</Timestamp>
<BaseAddress>0x76240000</BaseAddress>
<Size>1691648</Size>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Setup API</Description>
</module>
<module>
<Timestamp>130412103633575054</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103633632686</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\System32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103633631740</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103633753474</Timestamp>
<BaseAddress>0x76600000</BaseAddress>
<Size>12288</Size>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Unicode Normalization DLL</Description>
</module>
<module>
<Timestamp>130412103633630706</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103633674271</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\System32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103633699518</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\System32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103633635459</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103633625313</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103633749605</Timestamp>
<BaseAddress>0x76870000</BaseAddress>
<Size>1114112</Size>
<Path>C:\Windows\System32\urlmon.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>OLE32 Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103633752205</Timestamp>
<BaseAddress>0x769f0000</BaseAddress>
<Size>1155072</Size>
<Path>C:\Windows\System32\wininet.dll</Path>
<Version>9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)</Version>
<Company>Microsoft Corporation</Company>
<Description>Internet Extensions for Win32</Description>
</module>
<module>
<Timestamp>130412103633751100</Timestamp>
<BaseAddress>0x76b10000</BaseAddress>
<Size>1802240</Size>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Version>9.00.8112.16437 (WIN7_IE9_GDR.110831-1745)</Version>
<Company>Microsoft Corporation</Company>
<Description>Run time utility for Internet Explorer</Description>
</module>
<module>
<Timestamp>130412103633637170</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\System32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103633675645</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\System32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103633628755</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\System32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103633626917</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103633633912</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\System32\shell32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103633412585</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103633722951</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
<process>
<ProcessIndex>282</ProcessIndex>
<ProcessId>4388</ProcessId>
<ParentProcessId>1164</ParentProcessId>
<ParentProcessIndex>281</ParentProcessIndex>
<AuthenticationId>00000000:00021a24</AuthenticationId>
<CreateTime>130412103634851676</CreateTime>
<FinishTime>130412103980627983</FinishTime>
<IsVirtualized>0</IsVirtualized>
<Is64bit>0</Is64bit>
<Integrity>High</Integrity>
<Owner>tom\manono</Owner>
<ProcessName>WerFault.exe</ProcessName>
<ImagePath>C:\Windows\system32\WerFault.exe</ImagePath>
<CommandLine>C:\Windows\system32\WerFault.exe -u -p 1164 -s 644</CommandLine>
<CompanyName>Microsoft Corporation</CompanyName>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Description>Windows Problem Reporting</Description>
<modulelist>
<module>
<Timestamp>130412103635011244</Timestamp>
<BaseAddress>0x130000</BaseAddress>
<Size>372736</Size>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Problem Reporting</Description>
</module>
<module>
<Timestamp>130412103635230472</Timestamp>
<BaseAddress>0x550000</BaseAddress>
<Size>499712</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130412103635629792</Timestamp>
<BaseAddress>0x1710000</BaseAddress>
<Size>499712</Size>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Version>0.0.0.0</Version>
<Company></Company>
<Description> </Description>
</module>
<module>
<Timestamp>130412103635278969</Timestamp>
<BaseAddress>0x58630000</BaseAddress>
<Size>2740224</Size>
<Path>C:\Windows\System32\dbgeng.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Symbolic Debugger Engine</Description>
</module>
<module>
<Timestamp>130412103635250995</Timestamp>
<BaseAddress>0x64620000</BaseAddress>
<Size>1179648</Size>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscordacwks.dll</Path>
<Version>4.0.30319.239 (RTMGDR.030319-2300)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft .NET External Data Access Support</Description>
</module>
<module>
<Timestamp>130412103635172399</Timestamp>
<BaseAddress>0x64970000</BaseAddress>
<Size>335872</Size>
<Path>C:\Windows\System32\Faultrep.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows User Mode Crash Reporting DLL</Description>
</module>
<module>
<Timestamp>130412103635617983</Timestamp>
<BaseAddress>0x67970000</BaseAddress>
<Size>483328</Size>
<Path>C:\Windows\System32\riched20.dll</Path>
<Version>5.31.23.1230</Version>
<Company>Microsoft Corporation</Company>
<Description>Rich Text Edit Control, v3.1</Description>
</module>
<module>
<Timestamp>130412103635568904</Timestamp>
<BaseAddress>0x688b0000</BaseAddress>
<Size>172032</Size>
<Path>C:\Windows\System32\werui.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Error Reporting UI DLL</Description>
</module>
<module>
<Timestamp>130412103635283006</Timestamp>
<BaseAddress>0x68c50000</BaseAddress>
<Size>962560</Size>
<Path>C:\Windows\System32\dbghelp.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Image Helper</Description>
</module>
<module>
<Timestamp>130412103635124732</Timestamp>
<BaseAddress>0x70b90000</BaseAddress>
<Size>258048</Size>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Version>8.0.1506.399</Version>
<Company>AVAST Software</Company>
<Description>avast! snxhk</Description>
</module>
<module>
<Timestamp>130412103635547411</Timestamp>
<BaseAddress>0x70bd0000</BaseAddress>
<Size>24576</Size>
<Path>C:\Windows\System32\SensApi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>SENS Connectivity API DLL</Description>
</module>
<module>
<Timestamp>130412103635161388</Timestamp>
<BaseAddress>0x73630000</BaseAddress>
<Size>397312</Size>
<Path>C:\Windows\System32\wer.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Error Reporting DLL</Description>
</module>
<module>
<Timestamp>130412103635652947</Timestamp>
<BaseAddress>0x74a20000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\System32\xmllite.dll</Path>
<Version>1.3.1001.0</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft XmlLite Library</Description>
</module>
<module>
<Timestamp>130412103635647940</Timestamp>
<BaseAddress>0x74a50000</BaseAddress>
<Size>77824</Size>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft Desktop Window Manager API</Description>
</module>
<module>
<Timestamp>130412103635610047</Timestamp>
<BaseAddress>0x74af0000</BaseAddress>
<Size>192512</Size>
<Path>C:\Windows\System32\duser.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUser Engine</Description>
</module>
<module>
<Timestamp>130412103635598379</Timestamp>
<BaseAddress>0x74b20000</BaseAddress>
<Size>729088</Size>
<Path>C:\Windows\System32\dui70.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows DirectUI Engine</Description>
</module>
<module>
<Timestamp>130412103635167497</Timestamp>
<BaseAddress>0x74e70000</BaseAddress>
<Size>1695744</Size>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll</Path>
<Version>6.10 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>User Experience Controls Library</Description>
</module>
<module>
<Timestamp>130412103635641338</Timestamp>
<BaseAddress>0x758e0000</BaseAddress>
<Size>262144</Size>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft UxTheme Library</Description>
</module>
<module>
<Timestamp>130412103635216409</Timestamp>
<BaseAddress>0x75a10000</BaseAddress>
<Size>36864</Size>
<Path>C:\Windows\System32\version.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Version Checking and File Installation Libraries</Description>
</module>
<module>
<Timestamp>130412103635255331</Timestamp>
<BaseAddress>0x75a50000</BaseAddress>
<Size>53248</Size>
<Path>C:\Windows\System32\wtsapi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Remote Desktop Session Host Server SDK APIs</Description>
</module>
<module>
<Timestamp>130412103635176556</Timestamp>
<BaseAddress>0x75de0000</BaseAddress>
<Size>311296</Size>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Application Compatibility Client Library</Description>
</module>
<module>
<Timestamp>130412103635589338</Timestamp>
<BaseAddress>0x75e30000</BaseAddress>
<Size>49152</Size>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Base cryptographic API DLL</Description>
</module>
<module>
<Timestamp>130412103635127289</Timestamp>
<BaseAddress>0x76160000</BaseAddress>
<Size>303104</Size>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103635152953</Timestamp>
<BaseAddress>0x761b0000</BaseAddress>
<Size>585728</Size>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Version>6.1.7601.17676</Version>
<Company>Microsoft Corporation</Company>
<Description></Description>
</module>
<module>
<Timestamp>130412103635125917</Timestamp>
<BaseAddress>0x763e0000</BaseAddress>
<Size>868352</Size>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT BASE API Client DLL</Description>
</module>
<module>
<Timestamp>130412103635149701</Timestamp>
<BaseAddress>0x764c0000</BaseAddress>
<Size>643072</Size>
<Path>C:\Windows\System32\usp10.dll</Path>
<Version>1.0626.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Uniscribe Unicode script processor</Description>
</module>
<module>
<Timestamp>130412103635148440</Timestamp>
<BaseAddress>0x76560000</BaseAddress>
<Size>40960</Size>
<Path>C:\Windows\System32\lpk.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Language Pack</Description>
</module>
<module>
<Timestamp>130412103635147289</Timestamp>
<BaseAddress>0x76610000</BaseAddress>
<Size>319488</Size>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>GDI Client DLL</Description>
</module>
<module>
<Timestamp>130412103635155540</Timestamp>
<BaseAddress>0x76660000</BaseAddress>
<Size>126976</Size>
<Path>C:\Windows\System32\imm32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows IMM32 API Client DLL</Description>
</module>
<module>
<Timestamp>130412103635140216</Timestamp>
<BaseAddress>0x76680000</BaseAddress>
<Size>102400</Size>
<Path>C:\Windows\System32\sechost.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Host for SCM/SDDL/LSA Lookup APIs</Description>
</module>
<module>
<Timestamp>130412103635154271</Timestamp>
<BaseAddress>0x766a0000</BaseAddress>
<Size>356352</Size>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Shell Light-weight Utility Library</Description>
</module>
<module>
<Timestamp>130412103635136109</Timestamp>
<BaseAddress>0x767c0000</BaseAddress>
<Size>704512</Size>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Version>7.0.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows NT CRT DLL</Description>
</module>
<module>
<Timestamp>130412103635210073</Timestamp>
<BaseAddress>0x769e0000</BaseAddress>
<Size>20480</Size>
<Path>C:\Windows\System32\psapi.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Process Status Helper</Description>
</module>
<module>
<Timestamp>130412103635151213</Timestamp>
<BaseAddress>0x76cd0000</BaseAddress>
<Size>1425408</Size>
<Path>C:\Windows\System32\ole32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Microsoft OLE for Windows</Description>
</module>
<module>
<Timestamp>130412103635156578</Timestamp>
<BaseAddress>0x76e40000</BaseAddress>
<Size>835584</Size>
<Path>C:\Windows\System32\msctf.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>MSCTF Server DLL</Description>
</module>
<module>
<Timestamp>130412103635145379</Timestamp>
<BaseAddress>0x76f40000</BaseAddress>
<Size>823296</Size>
<Path>C:\Windows\System32\user32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Multi-User Windows USER API Client DLL</Description>
</module>
<module>
<Timestamp>130412103635142792</Timestamp>
<BaseAddress>0x77010000</BaseAddress>
<Size>659456</Size>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Remote Procedure Call Runtime</Description>
</module>
<module>
<Timestamp>130412103635621031</Timestamp>
<BaseAddress>0x770c0000</BaseAddress>
<Size>12886016</Size>
<Path>C:\Windows\System32\shell32.dll</Path>
<Version>6.1.7601.17514 (win7sp1_rtm.101119-1850)</Version>
<Company>Microsoft Corporation</Company>
<Description>Windows Shell Common Dll</Description>
</module>
<module>
<Timestamp>130412103635013448</Timestamp>
<BaseAddress>0x77d10000</BaseAddress>
<Size>1294336</Size>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>NT Layer DLL</Description>
</module>
<module>
<Timestamp>130412103635135209</Timestamp>
<BaseAddress>0x77e50000</BaseAddress>
<Size>655360</Size>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Version>6.1.7600.16385 (win7_rtm.090713-1255)</Version>
<Company>Microsoft Corporation</Company>
<Description>Advanced Windows 32 Base API</Description>
</module>
</modulelist>
</process>
</processlist><eventlist>
<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3401057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>Process Start</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Parent PID: 1772, Command line: &quot;C:\Program Files\MKV2AC3\MKV2AC3.exe&quot; , Current directory: C:\Program Files\MKV2AC3\, Environment: 

	=::=::\

	ALLUSERSPROFILE=C:\ProgramData

	AMDAPPSDKROOT=C:\Program Files\AMD APP\

	APPDATA=C:\Users\manono\AppData\Roaming

	CommonProgramFiles=C:\Program Files\Common Files

	COMPUTERNAME=TOM

	ComSpec=C:\Windows\system32\cmd.exe

	FP_NO_HOST_CHECK=NO

	HOMEDRIVE=C:

	HOMEPATH=\Users\manono

	LOCALAPPDATA=C:\Users\manono\AppData\Local

	LOGONSERVER=\\TOM

	NUMBER_OF_PROCESSORS=8

	OS=Windows_NT

	Path=C:\Program Files\AMD APP\bin\x86;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static

	PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

	PROCESSOR_ARCHITECTURE=x86

	PROCESSOR_IDENTIFIER=x86 Family 6 Model 30 Stepping 5, GenuineIntel

	PROCESSOR_LEVEL=6

	PROCESSOR_REVISION=1e05

	ProgramData=C:\ProgramData

	ProgramFiles=C:\Program Files

	PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\

	PUBLIC=C:\Users\Public

	SESSIONNAME=Console

	SystemDrive=C:

	SystemRoot=C:\Windows

	TEMP=C:\Users\manono\AppData\Local\Temp

	TMP=C:\Users\manono\AppData\Local\Temp

	USERDOMAIN=tom

	USERNAME=manono

	USERPROFILE=C:\Users\manono

	windir=C:\Windows

	windows_tracing_flags=3

	windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3401067 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 4560</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3451299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\MKV2AC3\MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3451450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x1180000, Image Size: 0x7a000</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3451585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\ntdll.dll</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3452105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3452270 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3452348 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3453350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x77d10000, Image Size: 0x13c000</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3453846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3454000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 86,016, EndOfFile: 84,110, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3454059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 84,110, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3454964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3455342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Write Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3455546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryInformationVolume</Operation>
<Path>C:</Path>
<Result>SUCCESS</Result>
<Detail>VolumeCreationTime: 11/13/2011 6:49:21 AM, VolumeSerialNumber: 2231-FB9D, SupportsObjects: True, VolumeLabel: </Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3455625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3456290 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\PROGRAM FILES</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3456446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3456511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000003c</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3456570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3456762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3457263 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST SOFTWARE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3457419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\AVAST Software</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3457478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\AVAST Software</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0xb00000000b97e</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3457538 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\AVAST Software</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3457611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST Software</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3458125 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST Software\AVAST</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3458284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3458343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x400000000b980</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3458397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\AVAST Software\Avast</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3458610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3459128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3459281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3459343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0xf00000001533e</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3459402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3459605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3460106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3460262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3460327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000020b</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3460383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3460575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3461108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\APPPATCH</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3461289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3461353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000020f</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3461410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3461607 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3462130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\ASSEMBLY</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3462286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3462359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000212</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3462421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3462615 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3463148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3463304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3463364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000466</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3463420 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3463633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3464191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3464355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3464417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x500000000c7ff</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3464474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3464547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3465078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3465242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3465301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x600000000c933</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3465358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3465431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3465932 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3466102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3466164 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000469</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3466220 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3466301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3466821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3466983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3467042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000046a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3467126 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3467201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3467718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3467880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3467939 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000473</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3467996 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3468085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3468600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3468748 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3468807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000479</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3468864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3468934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3469462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3469642 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3469699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000047a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3469756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3469847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3470389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3470545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3470607 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000474</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3470664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3470736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3471367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\GLOBALIZATION</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3471572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Globalization</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3471637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Globalization</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000004f6</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3471696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Globalization</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3471774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Globalization</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3472313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Globalization\SORTING</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3472493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3472558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000510</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3472620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Globalization\Sorting</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3472690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Globalization\Sorting</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3473213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\MICROSOFT.NET</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3473372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3473431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000005dc</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3473485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3473679 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3474205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\FRAMEWORK</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3474358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3474417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000691</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3474471 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3474671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3475188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3475342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3475401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000006c3</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3475458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3475671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3476188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3476355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3476414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000006c5</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3476471 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3476665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3477180 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\SYSTEM32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3477336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3477395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000780</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3477457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3477813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3478389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3478570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3478632 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002293</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3478694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3478769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3479330 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3479753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3479823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3479882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000054e5</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3479925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3479963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,290,240, EndOfFile: 1,288,488, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3480036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3480497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3480672 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3480739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3480785 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1800000000ba84</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3480828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3480863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 245,760, EndOfFile: 243,032, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3480925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3481362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3481782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3481866 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3481914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052a2</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3481957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3481990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 868,352, EndOfFile: 868,352, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3482060 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3482526 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3482690 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3482755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3482811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004da6</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3482857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3482890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 8,192, EndOfFile: 6,656, NumberOfLinks: 3, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3482960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apisetschema.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3483434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3483601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3483677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3483738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052a4</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3483782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3483817 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 290,816, EndOfFile: 290,816, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3483884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3484337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3484833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3484903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3484948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005381</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3484992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3485029 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 299,008, EndOfFile: 297,808, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3485102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3485576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3486042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3486110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3486158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052dc</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3486199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3486234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 421,888, EndOfFile: 419,880, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3486301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\locale.nls</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3486727 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3486891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3486956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3487002 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x14000000015336</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3487042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3487075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 466,944, EndOfFile: 466,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3487134 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3487791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3488225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3488303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3488352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004daa</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3488392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3488427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 299,008, EndOfFile: 295,936, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3488492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3488953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3489360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3489443 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3489540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002ec1</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3489643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3489683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3489756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3490265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3490723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3490796 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3490855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002eb9</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3490898 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3490933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 565,248, EndOfFile: 562,176, NumberOfLinks: 4, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3491001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3491456 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3491906 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3491976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3492022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005759</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3492065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3492100 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 102,400, EndOfFile: 100,352, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3492168 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3492609 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3493027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3493095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3493140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000053ff</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3493183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3493227 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 692,224, EndOfFile: 690,688, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3493294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3493749 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3494181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3494248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3494294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005669</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3494334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3494366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 655,360, EndOfFile: 653,312, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3494434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3494868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3495280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3495347 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3495393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005836</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3495434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3495469 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 815,104, EndOfFile: 811,520, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3495544 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\user32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3496008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3496425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3496493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3496538 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005119</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3496581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3496614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 307,200, EndOfFile: 304,640, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3496681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3497107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3497517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3497581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3497630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052ee</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3497670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3497702 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 28,672, EndOfFile: 26,624, NumberOfLinks: 4, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3497770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\lpk.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3498206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3498616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3498683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3498729 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000583f</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3498770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3498802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 626,688, EndOfFile: 626,176, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3498869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\usp10.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3499292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3499750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3499818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3499864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056f2</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3499904 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3499939 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,873,728, EndOfFile: 12,872,192, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3500006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shell32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3500454 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3500869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3500933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3500979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056fc</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3501020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3501052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 352,256, EndOfFile: 350,208, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3501117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3501542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3501957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3502022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3502068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000552c</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3502108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3502141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,417,216, EndOfFile: 1,414,144, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3502205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ole32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3502642 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3503068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3503132 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3503178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005534</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3503219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3503251 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 573,440, EndOfFile: 571,904, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3503318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3503803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3504237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3504305 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3504350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000583b</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3504393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3504426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 81,920, EndOfFile: 81,920, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3504493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\userenv.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3504924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3505361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3505426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3505474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000055c3</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3505514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3505547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 32,768, EndOfFile: 31,744, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3505614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3506043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3506455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3506520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3506565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000592b</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3506606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3506638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 323,584, EndOfFile: 320,000, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3506706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winspool.drv</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3507153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3507565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3507643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3507689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005360</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3507730 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3507762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 65,536, EndOfFile: 64,000, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3507829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mpr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3508258 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3508670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3508735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3508780 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000051aa</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3508821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3508853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 118,784, EndOfFile: 118,272, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3508918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3509344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3509756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3509821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3509869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005386</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3509918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3509950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 831,488, EndOfFile: 828,928, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3510017 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msctf.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3510440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3510847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3510912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3510958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002eb8</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3510998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3511031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 2,179,072, EndOfFile: 2,175,488, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3511098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcGenral.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3511526 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3511941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3512006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3512055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056b9</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3512095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3512127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 94,208, EndOfFile: 92,160, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3512203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3512637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3513049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3513114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3513159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005849</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3513200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3513232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 249,856, EndOfFile: 249,856, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3513297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3513763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3514189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3514259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3514305 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000590e</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3514345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3514377 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 196,608, EndOfFile: 194,048, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3514461 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winmm.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3514903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3515312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3515380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3515426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005680</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3515466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3515498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 53,248, EndOfFile: 51,200, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3515563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3515997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3516412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3516477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3516522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005370</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3516563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3516598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 73,728, EndOfFile: 72,192, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3516663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3517104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3517519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3517584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3517630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004d6f</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3517670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3517705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 643,072, EndOfFile: 640,512, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3517770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3518196 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3518605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3518673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3518719 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000586b</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3518759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3518791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 24,576, EndOfFile: 21,504, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3518856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\version.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3519290 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3519708 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3519772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3519818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056e9</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3519858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3519891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,096, EndOfFile: 2,560, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3519955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3520384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3520799 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3520866 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3520912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056eb</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3520955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3521006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 40,960, EndOfFile: 40,960, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3521082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc_os.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3521524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3521963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3522030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3522079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005061</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3522119 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3522154 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 69,632, EndOfFile: 67,072, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3522222 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3522683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3523127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3523197 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3523243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056df</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3523286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3523318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,671,168, EndOfFile: 1,667,584, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3523391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3523855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3524286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3524361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3524429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004e61</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3524472 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3524507 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 147,456, EndOfFile: 145,920, NumberOfLinks: 4, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3524577 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3525019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3525437 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3525504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3525552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004fcc</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3525596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3525628 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 65,536, EndOfFile: 64,512, NumberOfLinks: 4, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3525714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\devobj.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3526159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3526579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3526663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3526711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000582f</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3526754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3526789 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,105,920, EndOfFile: 1,102,848, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3526916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\urlmon.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3527387 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3527964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3528037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3528134 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000518e</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3528231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3528274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,794,048, EndOfFile: 1,791,488, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3528406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3528907 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3529344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3529411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3529460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005903</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3529500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3529551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,130,496, EndOfFile: 1,126,912, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3529627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\wininet.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3530066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3530497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3530565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3530610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000054d9</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3530651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3530686 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,096, EndOfFile: 2,048, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3530753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3531182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3531594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3531661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3531710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002ebc</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3531756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3531842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 212,992, EndOfFile: 211,968, NumberOfLinks: 5, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3531998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3532516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3532960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3533046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3533095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005703</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3533138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3533173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,288, EndOfFile: 10,752, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3533240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shunimpl.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3533725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3533919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3533990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3534041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004e9f</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3534084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3534119 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3534181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3534636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3534852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3534922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3535035 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000043e3</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3535086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3535135 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 413,696, EndOfFile: 413,520, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3535199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3535668 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3535835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3535903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3535949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000571e</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3535992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3536024 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 40,960, EndOfFile: 38,400, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3536102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3536560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3536735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3536803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3536849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000368a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3536889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3536921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,003,520, EndOfFile: 1,000,444, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3537000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SortServer2003Compat.nls</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3537455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\CLR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3537633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3537722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3537773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000043cb</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3537816 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3537848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 6,725,632, EndOfFile: 6,724,424, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3537913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3538371 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSVCR100_CLR0400.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3538544 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3538611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3538662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000053fe</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3538703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3538738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 774,144, EndOfFile: 771,424, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3538797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3539268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3539444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3539508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3539557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000440e</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3539597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3539630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 36,864, EndOfFile: 35,955, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3539692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3540128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3540292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3540360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3540403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000003689</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3540443 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3540508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 2,945,024, EndOfFile: 2,944,004, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3540586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SortDefault.nls</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3541066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3541252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3541319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3541370 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fe0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3541413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3541446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 14,409,728, EndOfFile: 14,407,680, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3541508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3541971 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3542400 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3542475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3542524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000566c</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3542564 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3542596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 376,832, EndOfFile: 376,832, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3542661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3543106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3543276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3543354 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3543467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004ecd</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3543564 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3543639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 36,864, EndOfFile: 36,864, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3543747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3544362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\NLSSORTING.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3544585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3544669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3544720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000043ef</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3544763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3544798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 57,344, EndOfFile: 56,656, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3544871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3545359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\SORTDEFAULT.NLP</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3545542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3545609 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3545655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000003f2a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3545698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3545730 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 2,957,312, EndOfFile: 2,956,620, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3545809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3546299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3546482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3546550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3546598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fe9</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3546641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3546676 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 9,089,024, EndOfFile: 9,086,464, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3546749 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3547226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE\SYSTEM.CORE.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3547401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3547469 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3547522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fec</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3547568 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3547603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 7,069,696, EndOfFile: 7,069,696, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3547676 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3548148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8\MICROSOFT.VISUALBASIC.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3548325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3548393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3548441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1a500000000c930</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3548482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3548517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,740,800, EndOfFile: 1,739,776, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3548581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3549031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCORRC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3549207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3549274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3549322 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000043e8</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3549363 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3549395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 372,736, EndOfFile: 372,048, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3549457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3549915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3550357 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3550430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3550497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000058c8</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3550543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3550576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 360,448, EndOfFile: 360,448, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3550638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3551238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3551432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3551697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3551861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3552020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3552163 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3552300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3552446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3552588 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3552739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3552818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3552936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3552998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3553130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3553192 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3553303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apisetschema.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3553362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3553475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3553534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3553650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3553726 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3553890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3553960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3554073 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3554135 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3554251 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3554313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3554424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3554480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3554596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3554658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3554774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3554841 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3554957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\user32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3555019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3555127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3555189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3555294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\lpk.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3555351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3555464 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\usp10.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3555523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3557646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shell32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3557722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3557846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3557908 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3558034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ole32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3558096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3558210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3558269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3558377 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\userenv.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3558436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3558541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3558598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3558716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winspool.drv</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3558776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3558883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mpr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3558943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3559050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3559110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3559231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msctf.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3559290 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3559438 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcGenral.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3559498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3559608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3559673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3559786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3559843 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3559953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winmm.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3560012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3560120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3560179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3560287 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3560347 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3560468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3560530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3560646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\version.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3560705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3560813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3560869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3560980 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc_os.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3561036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3561147 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3561206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3561338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3561398 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3561511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3561570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3561675 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\devobj.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3561734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3561856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\urlmon.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3561915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3562055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3562120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3562244 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\wininet.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3562300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3562408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3562473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3563012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3563082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3563233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shunimpl.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3563297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3563410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3563472 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3563607 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3563677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3563869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3563933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3573966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3574076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3574699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3574769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3581263 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3581373 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3581500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3581565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3581764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3581837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3584297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3584408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3586720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3586819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3587534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3587606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3588261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3589754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3589975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3590139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3590282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3590428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3590571 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3590740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3590899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3591047 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3591193 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3591336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3591549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3591694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3591840 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3591980 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3592133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3592292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3592433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3592570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3592721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3592858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3592996 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3593136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3593273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3593427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3593594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3593764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3593915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3594066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3594230 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3594397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3594534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3594688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3594828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3594966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3595125 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3595265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3595432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3595572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3595709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3595849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3596000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3596138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3596275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3596415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3596553 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3596709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3596882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3597030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3597186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3597332 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3597472 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3597628 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3597779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3597922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3598067 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3598213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3598385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3598547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>CloseFile</Operation>
<Path>C:</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3598854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 4560, User Time: 0.0000000, Kernel Time: 0.0156001</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3601640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\MKV2AC3\MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3601826 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\ntdll.dll</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3601964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\apisetschema.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\apisetschema.dll</Detail>
</event>

<event>
<ProcessIndex>277</ProcessIndex>
<Time_of_Day>12:26:01.3602433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>6092</PID>
<Operation>Process Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Exit Status: -1073740756, User Time: 0.0000000 seconds, Kernel Time: 0.0156001 seconds, Private Bytes: 221,184, Peak Private Bytes: 221,184, Working Set: 151,552, Peak Working Set: 151,552</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3318383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Process Start</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Parent PID: 1772, Command line: &quot;C:\Program Files\MKV2AC3\MKV2AC3.exe&quot; , Current directory: C:\Program Files\MKV2AC3\, Environment: 

	ALLUSERSPROFILE=C:\ProgramData

	AMDAPPSDKROOT=C:\Program Files\AMD APP\

	APPDATA=C:\Users\manono\AppData\Roaming

	CommonProgramFiles=C:\Program Files\Common Files

	COMPUTERNAME=TOM

	ComSpec=C:\Windows\system32\cmd.exe

	FP_NO_HOST_CHECK=NO

	HOMEDRIVE=C:

	HOMEPATH=\Users\manono

	LOCALAPPDATA=C:\Users\manono\AppData\Local

	LOGONSERVER=\\TOM

	NUMBER_OF_PROCESSORS=8

	OS=Windows_NT

	Path=C:\Program Files\AMD APP\bin\x86;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files\ATI Technologies\ATI.ACE\Core-Static

	PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

	PROCESSOR_ARCHITECTURE=x86

	PROCESSOR_IDENTIFIER=x86 Family 6 Model 30 Stepping 5, GenuineIntel

	PROCESSOR_LEVEL=6

	PROCESSOR_REVISION=1e05

	ProgramData=C:\ProgramData

	ProgramFiles=C:\Program Files

	PSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\

	PUBLIC=C:\Users\Public

	SystemDrive=C:

	SystemRoot=C:\Windows

	TEMP=C:\Users\manono\AppData\Local\Temp

	TMP=C:\Users\manono\AppData\Local\Temp

	USERDOMAIN=tom

	USERNAME=manono

	USERPROFILE=C:\Users\manono

	windir=C:\Windows

	windows_tracing_flags=3

	windows_tracing_logfile=C:\BVTBin\Tests\installpackage\csilogfile.log</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3318393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 6008</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3409766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\MKV2AC3\MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3409922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x1090000, Image Size: 0x7a000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3410132 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\ntdll.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3410868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3411110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3411226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3412585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x77d10000, Image Size: 0x13c000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3413242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3413436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 86,016, EndOfFile: 84,110, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3413495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 84,110, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3414549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Prefetch\MKV2AC3.EXE-708F06FC.pf</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3414948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Write Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Complete If Oplocked, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3415169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryInformationVolume</Operation>
<Path>C:</Path>
<Result>SUCCESS</Result>
<Detail>VolumeCreationTime: 11/13/2011 6:49:21 AM, VolumeSerialNumber: 2231-FB9D, SupportsObjects: True, VolumeLabel: </Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3415233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3415904 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\PROGRAM FILES</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3416066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3416139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000003c</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3416198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3416381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3416928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST SOFTWARE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3417087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\AVAST Software</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3417147 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\AVAST Software</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0xb00000000b97e</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3417206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\AVAST Software</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3417276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST Software</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3417777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST Software\AVAST</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3417931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3417993 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x400000000b980</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3418049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\AVAST Software\Avast</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3418249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3418774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3418922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3418984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0xf00000001533e</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3419038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3419238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3419742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\WINDOWS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3419925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3420003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000020b</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3420065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3420246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3420758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\APPPATCH</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3420911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3420970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000020f</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3421027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3421224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3421733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\ASSEMBLY</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3421889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3421949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000212</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3422019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3422218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3422752 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3422916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3422978 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000466</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3423037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3423245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3423878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3424048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3424112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x500000000c7ff</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3424183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3424255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3424867 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3425048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3425110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x600000000c933</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3425166 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3425236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3425810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3425977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3426039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000469</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3426096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3426169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3426726 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3426893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3426953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000046a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3427009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3427085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3427950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3428128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3428187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000473</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3428246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3428319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3428839 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3428998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3429057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000479</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3429117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3429187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3429699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3429866 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3429922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000047a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3429979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3430049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3430733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3430911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3430973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000474</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3431030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3431103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3431639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\GLOBALIZATION</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3431795 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Globalization</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3431854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Globalization</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000004f6</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3431911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Globalization</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3431981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Globalization</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3432480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Globalization\SORTING</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3432633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3432692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000510</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3432749 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Globalization\Sorting</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3432827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Globalization\Sorting</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3433337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\MICROSOFT.NET</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3433493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3433549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000005dc</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3433603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3433795 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3434299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\FRAMEWORK</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3434455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3434514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000691</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3434571 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3434794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3435333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\V4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3435492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3435573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000006c3</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3435705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3435956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3436565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3436737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3436802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000006c5</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3436861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3437082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3437618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\SYSTEM32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3437780 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3437842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000000780</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3437936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32</Path>
<Result>END OF FILE</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3438297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3438893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_5.82.7601.17514_NONE_EC83DFFA859149AF</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Complete If Oplocked, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3439065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3439130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002293</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3439203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_FILE_PREFETCH</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3439278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3439820 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3440251 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3440321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3440370 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000054e5</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3440416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3440453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,290,240, EndOfFile: 1,288,488, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3440531 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3440984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\SNXHK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3441157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3441224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3441270 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1800000000ba84</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3441313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3441348 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 245,760, EndOfFile: 243,032, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3441413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3441860 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3442296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3442364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3442412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052a2</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3442453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3442488 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 868,352, EndOfFile: 868,352, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3442558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3443054 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3443229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3443296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3443342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004da6</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3443388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3443420 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 8,192, EndOfFile: 6,656, NumberOfLinks: 3, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3443501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apisetschema.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3443970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3444129 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3444218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3444291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052a4</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3444355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3444406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 290,816, EndOfFile: 290,816, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3444493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3445156 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3445827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3445910 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3445975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005381</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3446026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3446064 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 299,008, EndOfFile: 297,808, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3446136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3446643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3447136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3447209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3447260 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052dc</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3447303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3447338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 421,888, EndOfFile: 419,880, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3447424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\locale.nls</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3447872 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.EXE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3448042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3448117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3448168 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x14000000015336</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3448211 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3448249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 466,944, EndOfFile: 466,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3448308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3449087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3449556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3449629 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3449677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004daa</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3449720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3449758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 299,008, EndOfFile: 295,936, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3449844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3450308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3450755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3450825 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3450903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002ec1</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3450957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3450995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3451068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3451518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3451944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3452035 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3452092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002eb9</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3452132 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3452170 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 565,248, EndOfFile: 562,176, NumberOfLinks: 4, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3452235 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3452687 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3453108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3453175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3453224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005759</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3453264 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3453299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 102,400, EndOfFile: 100,352, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3453366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3453800 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3454218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3454288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3454345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000053ff</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3454385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3454420 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 692,224, EndOfFile: 690,688, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3454506 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3455005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3455482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3455557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3455619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005669</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3455662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3455716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 655,360, EndOfFile: 653,312, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3455792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3456304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3456746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3456818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3456867 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005836</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3456910 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3456945 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 815,104, EndOfFile: 811,520, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3457015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\user32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3457465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3457877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3457942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3457990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005119</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3458031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3458063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 307,200, EndOfFile: 304,640, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3458128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3458559 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3458974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3459041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3459090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000052ee</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3459130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3459165 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 28,672, EndOfFile: 26,624, NumberOfLinks: 4, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3459233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\lpk.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3459680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3460138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3460206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3460251 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000583f</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3460294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3460329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 626,688, EndOfFile: 626,176, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3460397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\usp10.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3460912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3461383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3461456 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3461504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056f2</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3461547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3461593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,873,728, EndOfFile: 12,872,192, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3461663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shell32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3462159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3462588 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3462658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3462706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056fc</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3462747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3462782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 352,256, EndOfFile: 350,208, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3462854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3463369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3463806 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3463873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3463922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000552c</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3463962 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3464000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,417,216, EndOfFile: 1,414,144, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3464070 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ole32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3464514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3464959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3465048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3465107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005534</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3465150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3465185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 573,440, EndOfFile: 571,904, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3465258 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3465714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3466161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3466231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3466277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000583b</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3466325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3466360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 81,920, EndOfFile: 81,920, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3466433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\userenv.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3466872 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3467352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3467422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3467470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000055c3</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3467514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3467549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 32,768, EndOfFile: 31,744, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3467624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3468088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3468519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3468589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3468697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000592b</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3468767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3468807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 323,584, EndOfFile: 320,000, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3468880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winspool.drv</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3469438 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3469912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3469985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3470036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005360</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3470076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3470111 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 65,536, EndOfFile: 64,000, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3470184 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mpr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3470634 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3471146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3471219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3471281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000051aa</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3471345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3471397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 118,784, EndOfFile: 118,272, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3471491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3472062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3472685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3472790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3472865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005386</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3472927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3472968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 831,488, EndOfFile: 828,928, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3473075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msctf.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3473714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3474240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3474312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3474361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002eb8</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3474407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3474455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 2,179,072, EndOfFile: 2,175,488, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3474552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcGenral.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3475043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3475493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3475563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3475611 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056b9</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3475654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3475692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 94,208, EndOfFile: 92,160, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3475797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3476258 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3476708 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3476797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3476870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005849</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3476934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3476983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 249,856, EndOfFile: 249,856, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3477077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3477667 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3478169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3478252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3478309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000590e</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3478352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3478406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 196,608, EndOfFile: 194,048, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3478476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winmm.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3479031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3479516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3479605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3479651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005680</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3479694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3479731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 53,248, EndOfFile: 51,200, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3479802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3480324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3480774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3480844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3480898 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005370</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3480939 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3480976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 73,728, EndOfFile: 72,192, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3481044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3481496 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3481930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3482000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3482052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004d6f</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3482095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3482132 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 643,072, EndOfFile: 640,512, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3482219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3482682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3483103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3483183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3483229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000586b</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3483272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3483307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 24,576, EndOfFile: 21,504, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3483377 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\version.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3483841 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3484272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3484342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3484388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056e9</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3484431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3484466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,096, EndOfFile: 2,560, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3484533 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3485021 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3485466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3485536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3485584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056eb</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3485627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3485665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 40,960, EndOfFile: 40,960, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3485746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc_os.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3486231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3486668 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3486738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3486784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005061</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3486827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3486859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 69,632, EndOfFile: 67,072, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3486926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3487460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3488069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3488166 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3488220 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000056df</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3488260 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3488295 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,671,168, EndOfFile: 1,667,584, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3488395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3489079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3489556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3489643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3489694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004e61</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3489737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3489777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 147,456, EndOfFile: 145,920, NumberOfLinks: 4, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3489847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3490314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3490742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3490812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3490861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004fcc</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3490912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3490950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 65,536, EndOfFile: 64,512, NumberOfLinks: 4, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3491028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\devobj.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3491472 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3491895 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3491965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3492014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000582f</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3492057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3492089 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,105,920, EndOfFile: 1,102,848, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3492157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\urlmon.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3492593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3493014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3493095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3493146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000518e</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3493189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3493240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,794,048, EndOfFile: 1,791,488, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3493307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3493908 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3494560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3494668 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3494754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005903</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3494827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3494889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,130,496, EndOfFile: 1,126,912, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3495013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\wininet.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3495681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3496307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3496396 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3496506 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000054d9</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3496581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3496703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,096, EndOfFile: 2,048, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3496851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3497376 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3497845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3497915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3497969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002ebc</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3498037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3498077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 212,992, EndOfFile: 211,968, NumberOfLinks: 5, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3498169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3498632 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3499066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3499133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3499179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000005703</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3499222 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3499255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 12,288, EndOfFile: 10,752, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3499322 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shunimpl.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3499802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\COMCTL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3500031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3500101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3500149 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004e9f</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3500192 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3500230 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3500298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3500812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREEI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3501022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3501092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3501141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000043e3</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3501200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3501243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 413,696, EndOfFile: 413,520, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3501313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3501769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3501936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3502001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3502049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000571e</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3502089 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3502130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 40,960, EndOfFile: 38,400, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3502200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3502669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3502857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3502928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3502973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000368a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3503019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3503052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,003,520, EndOfFile: 1,000,444, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3503138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SortServer2003Compat.nls</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3503663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\CLR.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3503957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3504032 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3504081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000043cb</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3504124 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3504159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 6,725,632, EndOfFile: 6,724,424, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3504221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3504849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSVCR100_CLR0400.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3505137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3505223 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3505275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000053fe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3505318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3505355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 774,144, EndOfFile: 771,424, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3505415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3505894 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\MACHINE.CONFIG</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3506075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3506140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3506194 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000440e</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3506242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3506280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 36,864, EndOfFile: 35,955, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3506358 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3507075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3507352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3507425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3507476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000003689</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3507530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3507579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 2,945,024, EndOfFile: 2,944,004, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3507678 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SortDefault.nls</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3508225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2\MSCORLIB.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3508419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3508495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3508543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fe0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3508586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3508624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 14,409,728, EndOfFile: 14,407,680, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3508689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3509182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3509664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3509737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3509807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x100000000566c</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3509858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3509893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 376,832, EndOfFile: 376,832, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3509966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3510494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3510664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3510742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3510791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000004ecd</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3510834 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3510869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 36,864, EndOfFile: 36,864, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3510942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3511421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\NLSSORTING.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3511594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3511661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3511712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000043ef</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3511755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3511793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 57,344, EndOfFile: 56,656, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3511885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3512375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\SORTDEFAULT.NLP</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3512553 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3512634 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3512688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000003f2a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3512734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3512769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 2,957,312, EndOfFile: 2,956,620, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3512833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3513302 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756\SYSTEM.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3513483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3513596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3513653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fe9</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3513698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3513741 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 9,089,024, EndOfFile: 9,086,464, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3513836 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3514334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE\SYSTEM.CORE.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3514515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3514585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3514633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1000000002fec</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3514679 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3514728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 7,069,696, EndOfFile: 7,069,696, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3514792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3515329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8\MICROSOFT.VISUALBASIC.NI.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3515523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3515603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3515655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x1a500000000c930</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3515706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3515752 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,740,800, EndOfFile: 1,739,776, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3515819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3516714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCORRC.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3517007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3517107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3517161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000043e8</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3517207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3517272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 372,736, EndOfFile: 372,048, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3517374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3518085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Disposition: Open, Options: Non-Directory File, Complete If Oplocked, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3518578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>SetBasicInformationFile</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: -1, LastAccessTime: -1, LastWriteTime: -1, ChangeTime: -1, FileAttributes: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3518651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryAttributeTagFile</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>SUCCESS</Result>
<Detail>Attributes: A, ReparseTag: 0x0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3518724 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryFileInternalInformationFile</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>SUCCESS</Result>
<Detail>IndexNumber: 0x10000000058c8</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3518783 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3518821 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 360,448, EndOfFile: 360,448, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3518896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3519514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\LOCALE.NLS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3519705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\SYSMAIN.SDB</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3519982 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTSERVER2003COMPAT.NLS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3520141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3520290 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SORTDEFAULT.NLS</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3520441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\RPCSS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3520586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3520764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3520923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3521082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3521160 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3521306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3521376 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3521575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3521653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3521799 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apisetschema.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3521863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3521985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3522049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3522168 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3522235 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3522413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3522502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3522621 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3522688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3522812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3522885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3523000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3523065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3523213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3523281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3523424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3523499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3523626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\user32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3523723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3523847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3523919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3524033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\lpk.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3524097 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3524219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\usp10.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3524280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3526409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shell32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3526487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3526603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3526668 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3526805 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ole32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3526878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3526997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3527056 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3527180 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\userenv.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3527245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3527350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3527409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3527522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winspool.drv</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3527582 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3527695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mpr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3527757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3527875 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3527935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3528056 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msctf.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3528118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3528261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcGenral.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3528323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3528433 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3528495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3528608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3528670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3528789 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winmm.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3528851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3528961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3529020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3529131 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3529193 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3529314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3529376 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3529497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\version.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3529562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3529673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3529737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3529850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc_os.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3529912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3530028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3530098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3530236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3530306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3530430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3530495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3530621 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\devobj.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3530686 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3530831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\urlmon.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3530896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3531036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3531101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3531260 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\wininet.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3531335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3531459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3531521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3532079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3532168 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3532445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shunimpl.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3532551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3532680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3532747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3532906 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3532979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3533178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3533251 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3543181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3543305 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3543911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3543990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3550373 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3550479 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3550608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3550673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3550875 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3550955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3553348 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3553435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3555747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3555838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3556547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3556622 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3557382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3558875 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\NTDLL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3559094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3559261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\KERNEL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3559409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\APISETSCHEMA.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3559557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\KERNELBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3559705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3559864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3560010 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\APPHELP.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3560155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\ACLAYERS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3560325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SSPICLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3560479 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MSVCRT.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3560619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\RPCRT4.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3560759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\USER32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3560896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\GDI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3561036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\LPK.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3561236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\USP10.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3561381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SHELL32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3561519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SHLWAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3561656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\OLE32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3561815 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\OLEAUT32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3561980 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\USERENV.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3562122 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\PROFAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3562265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3562408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MPR.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3562567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3562710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MSCTF.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3562855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\ACGENRAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3563020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SECHOST.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3563179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\UXTHEME.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3563330 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WINMM.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3563478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SAMCLI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3563634 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MSACM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3563780 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\ADVAPI32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3563922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\VERSION.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3564087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SFC.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3564267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SFC_OS.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3564413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\DWMAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3564558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SETUPAPI.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3564734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\CFGMGR32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3564925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\DEVOBJ.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3565122 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\URLMON.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3565273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\IERTUTIL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3565413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WININET.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3565566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\NORMALIZ.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3565712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\ACXTRNAL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3565852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3565992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3566159 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3566307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SORTSERVER2003COMPAT.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3566450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3566596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3566755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3566911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3567073 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3567237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3567396 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3567541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3567706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WERFAULT.EXE</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3567916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3568509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3568627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3568835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\CWDIllegalInDLLSearch</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 1,024</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3568889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3569829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3571088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3571287 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 4/1/2014 12:01:38 PM, LastAccessTime: 1/22/2014 4:51:28 AM, LastWriteTime: 1/22/2014 4:51:28 AM, ChangeTime: 4/1/2014 12:07:43 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3571341 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3571893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3572152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3572308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3572454 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3573871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x70b90000, Image Size: 0x3f000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3574009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3575054 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x763e0000, Image Size: 0xd4000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3576908 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76160000, Image Size: 0x4a000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3578738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3579183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:08 AM, LastAccessTime: 11/20/2010 11:29:08 AM, LastWriteTime: 11/20/2010 11:29:08 AM, ChangeTime: 11/13/2011 6:56:29 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3579245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3579813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3580339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3580465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3580673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3581414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x690e0000, Image Size: 0x4a000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3581516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3585235 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3585324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3585472 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions\(Default)</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 36, Data: 00060101.00060101</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3585841 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3585903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3586033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 16</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3586569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3586639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\aswSP\Parameters</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3586814 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\aswSP\Parameters\BehavShield</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3586854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\aswSP\Parameters</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3586957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3587008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\aswSP\Parameters</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3587143 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\services\aswSP\Parameters\HookList</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3587175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\services\aswSP\Parameters</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3589167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\SafeBoot\Option</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value, Set Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3589245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\SafeBoot\Option</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value, Set Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3589304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Srp\GP\DLL</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3589352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Srp\GP\DLL</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3589404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3589560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 80</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3589595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3589692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3590754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3591188 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:13 AM, LastAccessTime: 11/20/2010 11:29:13 AM, LastWriteTime: 11/20/2010 11:29:13 AM, ChangeTime: 11/13/2011 6:56:12 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3591225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3591724 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3592217 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3592341 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3592492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3593319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75de0000, Image Size: 0x4c000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3593457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3594537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3595222 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3595491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3595553 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3595591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3595664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3595787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3596108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3596308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\ShowDebugInfo</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 256</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3596343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3596879 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3597151 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QuerySecurityFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Information: Owner, Group, DACL, SACL, Label</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3597218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 4/5/2014 12:17:51 PM, LastAccessTime: 4/5/2014 12:17:51 PM, LastWriteTime: 4/5/2014 4:17:22 PM, ChangeTime: 4/5/2014 12:18:13 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3597302 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QuerySecurityFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Information: Owner, Group, DACL, SACL, Label</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3597348 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 4/5/2014 12:17:51 PM, LastAccessTime: 4/5/2014 12:17:51 PM, LastWriteTime: 4/5/2014 4:17:22 PM, ChangeTime: 4/5/2014 12:18:13 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3597407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3599094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3599272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 4/5/2014 12:17:51 PM, LastAccessTime: 4/5/2014 12:17:51 PM, LastWriteTime: 4/5/2014 4:17:22 PM, ChangeTime: 4/5/2014 12:18:13 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3599331 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3600005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3600210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MKV2AC3, 1: MKV2AC3</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3600468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3601013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3601212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MKV2AC3.exe, 1: MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3601409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3601678 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3601867 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 146, Data: C:\Users\manono\AppData\Local\Microsoft\Windows\Temporary Internet Files</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3601931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3601977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3602131 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 40, Data: WINXPSP2 RUNASADMIN</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3602179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3602255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3602392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 1,024</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3602430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3603281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3603505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 4/5/2014 12:17:51 PM, LastAccessTime: 4/5/2014 12:17:51 PM, LastWriteTime: 4/5/2014 4:17:22 PM, ChangeTime: 4/5/2014 12:18:13 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3603573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3604138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3604338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MKV2AC3, 1: MKV2AC3</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3604543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3605319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3605540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MKV2AC3.exe, 1: MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3605747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3605998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3606189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 146, Data: C:\Users\manono\AppData\Local\Microsoft\Windows\Temporary Internet Files</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3606243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3606289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3606415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 40, Data: WINXPSP2 RUNASADMIN</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3606469 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3606545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3606666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 1,024</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3606698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611083 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Control Panel\Desktop\MuiCached\MachineLanguageConfiguration</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611290 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\MUI\Settings</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Policies\Microsoft\Control Panel\Desktop</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611568 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Control Panel\Desktop\LanguageConfiguration</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611684 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumValue</Operation>
<Path>HKCU\Control Panel\Desktop\LanguageConfiguration</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 0, Length: 512</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Control Panel\Desktop\LanguageConfiguration</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\MUI\Settings</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3611948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Policies\Microsoft\Control Panel\Desktop</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3612002 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Control Panel\Desktop</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3612085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Control Panel\Desktop\PreferredUILanguages</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 12</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3612144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Control Panel\Desktop</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3612171 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3612206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\MUI\Settings</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3612282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3612382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Control Panel\Desktop\MuiCached</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3612473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 12</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3612511 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_MULTI_SZ, Length: 12, Data: en-US</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3612559 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Control Panel\Desktop\MuiCached</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3612584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3613255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3613899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3614015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3615055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3615521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:07 AM, LastAccessTime: 11/20/2010 11:29:07 AM, LastWriteTime: 11/20/2010 11:29:07 AM, ChangeTime: 11/13/2011 6:53:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3615561 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3616089 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3616615 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3616758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3616922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3618943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x64bf0000, Image Size: 0x8d000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3619051 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3620266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\SspiCli.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3621234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SspiCli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3621713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\SspiCli.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:19 AM, LastAccessTime: 11/20/2010 11:29:19 AM, LastWriteTime: 11/20/2010 11:29:19 AM, ChangeTime: 11/13/2011 6:56:57 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3621751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SspiCli.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3622347 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SspiCli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3622907 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\SspiCli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3623039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SspiCli.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3623201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3624130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75dc0000, Image Size: 0x1b000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3624257 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SspiCli.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3625313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x767c0000, Image Size: 0xac000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3626917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x77010000, Image Size: 0xa1000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3628755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\user32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76f40000, Image Size: 0xc9000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3630706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76610000, Image Size: 0x4e000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3631740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\lpk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76560000, Image Size: 0xa000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3632686 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\usp10.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x764c0000, Image Size: 0x9d000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3633912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\shell32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x770c0000, Image Size: 0xc4a000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3635459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x766a0000, Image Size: 0x57000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3637170 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\ole32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76cd0000, Image Size: 0x15c000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3638992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x761b0000, Image Size: 0x8f000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3640520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\USERENV.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3641352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3641773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:13 AM, LastAccessTime: 11/20/2010 11:29:13 AM, LastWriteTime: 11/20/2010 11:29:13 AM, ChangeTime: 11/13/2011 6:56:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3641808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3642301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3642794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3642929 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3643091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\userenv.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3643805 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\userenv.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75b20000, Image Size: 0x17000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3643977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\USERENV.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3645505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\profapi.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3646351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3646772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:12:02 PM, LastAccessTime: 7/13/2009 1:12:02 PM, LastWriteTime: 7/13/2009 3:16:12 PM, ChangeTime: 11/13/2011 6:56:51 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3646807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3647316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3647828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3647949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3648095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3648787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75eb0000, Image Size: 0xb000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3648868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3650334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\WINSPOOL.DRV</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3651253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3651732 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:57:02 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3651770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3652290 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3652794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3652913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3653066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winspool.drv</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3653861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\winspool.drv</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x70a60000, Image Size: 0x51000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3654053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WINSPOOL.DRV</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3655672 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MPR.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3656631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MPR.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3657106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\MPR.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:55:36 PM, LastAccessTime: 7/13/2009 1:55:36 PM, LastWriteTime: 7/13/2009 3:15:41 PM, ChangeTime: 11/13/2011 6:56:26 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3657157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MPR.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3657709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MPR.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3658243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\MPR.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3658372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MPR.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3658550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\mpr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3659286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\mpr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x70570000, Image Size: 0x12000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3659391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MPR.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3662859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3663296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:20 AM, LastAccessTime: 11/20/2010 11:29:20 AM, LastWriteTime: 11/20/2010 11:29:20 AM, ChangeTime: 11/13/2011 6:56:23 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3663339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3663867 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3664476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3664597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3664635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 118,784, EndOfFile: 118,272, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3664729 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3664955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3665855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3666279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:20 AM, LastAccessTime: 11/20/2010 11:29:20 AM, LastWriteTime: 11/20/2010 11:29:20 AM, ChangeTime: 11/13/2011 6:56:23 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3666314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3666853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3667445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3667556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3667594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 118,784, EndOfFile: 118,272, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3667661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3667836 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3668760 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3669173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:20 AM, LastAccessTime: 11/20/2010 11:29:20 AM, LastWriteTime: 11/20/2010 11:29:20 AM, ChangeTime: 11/13/2011 6:56:23 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3669208 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3669701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3670178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3670291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3670434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3674271 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76660000, Image Size: 0x1f000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3674371 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\IMM32.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3675645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\msctf.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76e40000, Image Size: 0xcc000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3676925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Error Message Instrument\</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3677014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Error Message Instrument</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3677074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3677233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3677273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3677483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3677629 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32\MKV2AC3</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 172</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3677666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3677701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3678634 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3678779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3678884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3678963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\RequireSignedAppInit_DLLs</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3678995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3679035 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3680835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\OLE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3681000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Ole\PageAllocatorUseSystemHeap</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3681043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Ole</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3681081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\OLE</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3681218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Ole\PageAllocatorSystemHeapIsPrivate</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3681256 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Ole</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3681412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\OLE\Tracing</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3681927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\OLEAUT</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3682075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\OLEAUT</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3683412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\system\CurrentControlSet\control\NetworkProvider\HwOrder</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3683487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\control\NetworkProvider\HwOrder</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3685462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3686152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3686273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3687653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3688313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3688421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3689591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3690237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3690345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3691153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3691784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3691886 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3692757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3693161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:07 AM, LastAccessTime: 11/20/2010 11:29:07 AM, LastWriteTime: 11/20/2010 11:29:07 AM, ChangeTime: 11/13/2011 6:53:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3693199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3693697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3694182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3694298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3694495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcGenral.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3695271 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\AppPatch\AcGenral.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x5b970000, Image Size: 0x218000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3695406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3696893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3697349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:11:59 PM, LastAccessTime: 7/13/2009 1:11:59 PM, LastWriteTime: 7/13/2009 3:16:13 PM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3697392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3697917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3698418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3698542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3698771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3699518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76680000, Image Size: 0x19000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3700965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3702560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\UxTheme.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3703439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\UxTheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3703905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\UxTheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:40:46 PM, LastAccessTime: 7/13/2009 1:40:46 PM, LastWriteTime: 7/13/2009 3:16:17 PM, ChangeTime: 11/13/2011 6:56:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3703943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\UxTheme.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3704479 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\UxTheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3705158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\UxTheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3705282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\UxTheme.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3705441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3706228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x758e0000, Image Size: 0x40000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3706330 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\UxTheme.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3707912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\WINMM.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3708823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WINMM.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3709278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\WINMM.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:18 AM, LastAccessTime: 11/20/2010 11:29:18 AM, LastWriteTime: 11/20/2010 11:29:18 AM, ChangeTime: 11/13/2011 6:57:02 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3709321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WINMM.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3709917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WINMM.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3710458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\WINMM.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3710585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WINMM.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3710760 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\winmm.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3711679 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\winmm.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x742a0000, Image Size: 0x32000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3711795 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WINMM.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3713474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\samcli.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3714379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3714851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:06 AM, LastAccessTime: 11/20/2010 11:29:06 AM, LastWriteTime: 11/20/2010 11:29:06 AM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3714889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3715411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3715937 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3716061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3716217 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3717023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x74600000, Image Size: 0xf000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3717109 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3718494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MSACM32.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3719351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSACM32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3719769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\MSACM32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 2:03:29 PM, LastAccessTime: 7/13/2009 2:03:29 PM, LastWriteTime: 7/13/2009 3:15:42 PM, ChangeTime: 11/13/2011 6:56:29 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3719806 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MSACM32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3720318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSACM32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3720803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\MSACM32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3720925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\MSACM32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3721089 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3721787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x73ff0000, Image Size: 0x14000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3721876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\MSACM32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3722951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x77e50000, Image Size: 0xa0000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3725040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\VERSION.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3725983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\VERSION.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3726408 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\VERSION.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:41:45 PM, LastAccessTime: 7/13/2009 1:41:45 PM, LastWriteTime: 7/13/2009 3:16:17 PM, ChangeTime: 11/13/2011 6:56:59 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3726446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\VERSION.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3726958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\VERSION.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3727459 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\VERSION.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3727581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\VERSION.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3727772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\version.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3728494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\version.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75a10000, Image Size: 0x9000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3728583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\VERSION.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3729823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\sfc.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3731033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3731679 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:15:36 PM, LastAccessTime: 7/13/2009 1:15:36 PM, LastWriteTime: 7/13/2009 3:10:22 PM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3731720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3732318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3732854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3732978 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3733140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3733878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x70800000, Image Size: 0x3000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3733940 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3734921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\sfc_os.DLL</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3735778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\sfc_os.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3736196 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\sfc_os.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:15:41 PM, LastAccessTime: 7/13/2009 1:15:41 PM, LastWriteTime: 7/13/2009 3:16:14 PM, ChangeTime: 11/13/2011 6:56:54 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3736231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\sfc_os.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3736718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\sfc_os.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3737198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\sfc_os.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3737317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc_os.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3737468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\sfc_os.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3738279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\sfc_os.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x707f0000, Image Size: 0xd000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3738427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\sfc_os.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3739984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\dwmapi.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3741186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3741814 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:24:17 PM, LastAccessTime: 7/13/2009 1:24:17 PM, LastWriteTime: 7/13/2009 3:15:13 PM, ChangeTime: 11/13/2011 6:56:18 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3741863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3742464 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3742997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3743124 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3743277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3744072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x74a50000, Image Size: 0x13000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3744342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3745616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76240000, Image Size: 0x19d000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3746875 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75f30000, Image Size: 0x27000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3748341 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\devobj.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75f60000, Image Size: 0x12000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3749605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\urlmon.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76870000, Image Size: 0x110000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3751100 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76b10000, Image Size: 0x1b8000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3752205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\wininet.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x769f0000, Image Size: 0x11a000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3753474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x76600000, Image Size: 0x3000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3756058 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3757635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\Windows Error Reporting\WMR</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3757807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR\Disable</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3757856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\WMR</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3757950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\Setup</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\SourcePath</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758241 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758373 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DevicePath</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_EXPAND_SZ, Length: 34, Data: %SystemRoot%\inf</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758443 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\CustomLocale</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\CustomLocale</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\CustomLocale\en-US</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 532</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\CustomLocale</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale\en-US</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 532</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\ExtendedLocale</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3758955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3761550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3762200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3762313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3763245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3763876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3764000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3764937 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3765361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:26:53 PM, LastAccessTime: 7/13/2009 1:26:53 PM, LastWriteTime: 7/13/2009 3:14:52 PM, ChangeTime: 3/23/2014 6:33:47 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3765401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3765891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3766385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3766500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3767085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3767853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x5b0d0000, Image Size: 0x259000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3767966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3770957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3771623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3771744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3772674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3773455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3773569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3774310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3774994 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3775177 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3776048 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3776678 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3776789 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3777635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3778257 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3778363 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3779082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3779696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3779802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3780680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3781303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3781410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3781699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3781920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection\KnownDllList</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 16</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3781965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection\KnownDllList</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 22, Data: nlhtml.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3782017 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3782706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3783348 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3783456 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3784248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3784512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3784738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3786304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x3c0000, Image Size: 0x7a000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3786382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3786552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3786590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3787077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.Config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3787349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3787587 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 296, EndOfFile: 292, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3787673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3787724 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 296, EndOfFile: 292, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3787808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3788091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 4/5/2014 12:17:51 PM, LastAccessTime: 4/5/2014 12:17:51 PM, LastWriteTime: 4/5/2014 4:17:22 PM, ChangeTime: 4/5/2014 12:18:13 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3788514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3788813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3790812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\SHUNIMPL.DLL</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3791890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3792364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:55 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3792402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3793025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3793577 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3793698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3793908 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\shunimpl.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3794741 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\shunimpl.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x71780000, Image Size: 0x6000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3794817 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SHUNIMPL.DLL</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3795345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3796210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.Local</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3797169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3797352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:18 AM, LastAccessTime: 11/20/2010 11:29:18 AM, LastWriteTime: 11/20/2010 11:29:18 AM, ChangeTime: 11/13/2011 6:58:45 AM, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3797403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3797959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3799055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3799233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3799290 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3800362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3800898 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3801041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3801079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3801146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3801316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3802804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3803022 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3803065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3803693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3804181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3804315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3804369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3804439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3804620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3805692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3805870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3805911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3806466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3806902 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3807037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3807083 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3807150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3807298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3808333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3808506 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3808546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3809112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3809559 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3809694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3809732 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3809796 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3809945 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3810920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3811090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3811128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3811677 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3812111 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3812232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3812278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3812343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3812502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3813515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3813688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3813790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3814698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3815234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3815372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3815415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3815482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3815636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3816714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3816892 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3816932 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3817484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3817918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3818040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3818077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3818139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3818290 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3819268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3819465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3819503 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3820061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3820497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3820618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3820670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3820734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3820883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3821925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3822101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3822138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3822723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3823168 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3823283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3823321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3823383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3823531 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3824537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3824728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3824774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3825342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3825803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3825965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3826005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3826075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3826240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3827231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3827412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3827452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3828013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3828449 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3828568 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3828624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3828692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3828889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3830004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3830177 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3830214 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3830775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3831219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3831341 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3831389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3831457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3831616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3832605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3832796 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3832834 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3833383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3833812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3833941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3833979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3834041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3834189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3835286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3835461 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3835499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3836065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3836501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3836620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3836660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3836725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3836873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3837873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3838051 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3838088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3838651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3839088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3839201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3839239 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3839304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3839457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3840495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3840667 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3840705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3841236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3841659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3841775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3841812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3841874 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3842020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3843014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3843189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3843230 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3843769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3844197 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3844316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3844353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3844421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3844591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3845631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3845806 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3845844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3846450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3846900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3847032 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3847072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3847137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3847296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3848285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3848463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3848503 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3849053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3849473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3849589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3849624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3849689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3849835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3850807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3850977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3851015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3851570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3851990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3852106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3852144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3852209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3852365 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3853343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3853513 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3853553 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3854100 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3854534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3854655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3854693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3854777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3854928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3855933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3856108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3856148 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3856725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3857167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3857294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3857331 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3857396 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3857547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3858617 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3858792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3858832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3859374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3859805 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3859926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3859964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3860031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3860201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3861182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3861460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3861516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3862271 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3862737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3862861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3862899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3862963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3863136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3864232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3864413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3864453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3865041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3865480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3865601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3865639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3865706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3865855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3866827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3867000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3867038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3867617 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3868067 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3868196 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3868231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3868296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3868442 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3873597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3874327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3874542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\system\wing.dll</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: wing.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3874744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\system</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3875310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3875561 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32\wing.dll</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: wing.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3875744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3876297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3876485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\system\wing32.dll</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: wing32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3876636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\system</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3877175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3877375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32\wing32.dll</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: wing32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3877552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3881737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework\Policy\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3882007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail>Query: Cached, SubKeys: 5, Values: 0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3882077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail>Index: 4, Name: v4.0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3882150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail>Index: 3, Name: v2.0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3882187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail>Index: 2, Name: Upgrades</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3882220 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail>Index: 1, Name: Standards</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3882252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: AppPatch</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3882333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3882470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0</Path>
<Result>SUCCESS</Result>
<Detail>Query: Cached, SubKeys: 0, Values: 1</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3882565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: 30319, Type: REG_SZ, Length: 24, Data: 30319-30319</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3882645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\v4.0</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3883508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL.local</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3883777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3883985 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3884052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3884087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3884599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3884847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Filter: mscoreei.dll, 1: mscoreei.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3885095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3885286 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3885421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3885580 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3885623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3885655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3886138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3886340 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Filter: mscoreei.dll, 1: mscoreei.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3886607 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3886935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3887167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3887229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3887283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3888199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3888382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 5/17/2011 6:27:52 AM, LastAccessTime: 10/10/2011 5:31:18 AM, LastWriteTime: 5/17/2011 6:27:52 AM, ChangeTime: 11/30/2011 11:57:40 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3888426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3888956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3889210 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3889334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3889506 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3890977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x69070000, Image Size: 0x67000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3891074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3892713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3893346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3893389 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3893974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3894421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3894543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3894583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3894653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3894842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3895844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3896019 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3896070 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3896626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3897057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3897178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3897229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3897305 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3897466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3898539 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3898787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3898838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3899495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3899972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3900118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3900180 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3900258 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3900425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3901856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3902061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3902101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3902689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3903128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3903249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3903300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3903373 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3903583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3904664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3904858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3904896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3905456 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3905909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3906049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3906098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3906162 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3906321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3907291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3907464 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3907523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3908075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3908507 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3908625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3908666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3908749 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3908903 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3909892 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3910075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3910113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3910673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3911096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3911212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3911250 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3911312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3911457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3912465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3912640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3912681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3913249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3913680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3913799 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3913837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3913901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3914060 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3915144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3915324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3915365 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3915957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3916397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3916515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3916553 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3916618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3916769 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3917822 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3918003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3918043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3918633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3919062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3919180 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3919218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3919294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3919490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3920525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3920703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3920743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3921298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3921727 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3921845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3921883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3921948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3922126 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3923163 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3923338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3923379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3923996 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3924449 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3924599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3924643 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3924723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3924904 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3925941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3926117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3926157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3926720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3927157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3927278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3927316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3927380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3927531 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3928569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3928741 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3928782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3929323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3929752 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3929873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3929911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3929975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3930137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3931118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3931288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3931328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3931870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3932296 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3932419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3932457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3932522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3932773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3934066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3934284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3934338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3935090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3935807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3935998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3936060 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3936206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3936383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3937480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3937671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3937712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3938289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3938752 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3938876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3938916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3938997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3939151 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3940223 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3940401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3940439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3941032 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3941485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3941606 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3941646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3941714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3941864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3942872 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3943050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3943091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3943662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3944115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3944236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3944276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3944354 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3944505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3945535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3945715 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3945766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3946338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3946777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3946917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3946955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3947030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3947189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3948240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3948415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3948456 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3948992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3949418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3949536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3949571 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3949636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3949790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3950744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3950913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3950951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3951482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3951908 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3952034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3952069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3952131 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3952274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3953274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3953446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3953484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3954026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3954446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3954562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3954597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3954659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3954815 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3955791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3955963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3956001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3956535 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3956955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3957073 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3957108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3957173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3957329 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3958305 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3958477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3958512 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3959068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3959515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3959633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3959668 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3959733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3959879 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3960825 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3960994 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3961043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3961574 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3961991 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3962107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3962145 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3962207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3962352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3963533 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions\000000FF.000000FF</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 50, Data: SortServer2003Compat.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3964462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\SortServer2003Compat.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3965309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\SortServer2003Compat.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3966133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3966297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:15:47 PM, LastAccessTime: 7/13/2009 1:15:47 PM, LastWriteTime: 7/13/2009 3:16:14 PM, ChangeTime: 11/13/2011 6:56:55 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3966338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3966842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3967082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3967222 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3967451 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3969008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x728b0000, Image Size: 0xd000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3969122 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3970499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3970679 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3970733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3971293 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3971733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3971857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3971897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3971964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3972129 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3973104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3973271 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3973312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3973856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3974285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3974403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3974444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3974519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3974670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3975680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3975853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3975893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3976478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3976912 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3977031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3977068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3977133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3977284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3978232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3978413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3978453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3978992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3979415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3979534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3979572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3979636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3979790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3980757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3980927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3980968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3981525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3981970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3982091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3982129 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3982207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3982355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3983344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3983517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3983554 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3984099 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3984519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3984638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3984675 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3984756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3984910 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3985866 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3986050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3986090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3986626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3987052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3987171 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3987208 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3987273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3987424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3988421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3988594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3988645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3989216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3989644 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3989763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3989803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3989879 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3990041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3990992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3991162 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3991199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3991746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3992172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3992291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3992328 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3992393 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3992544 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3993509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3993695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3993735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3994266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3994692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3994829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3994870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3994937 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3995096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3996077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3996249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3996287 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3996823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3997249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3997368 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3997416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3997481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3997629 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3998588 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3998761 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3998798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3999375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3999804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3999922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.3999960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4000025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4000175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4001175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4001345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4001385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4001914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4002334 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4002455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4002493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4002558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4002708 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4003665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4003835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4003873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4004406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4004845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4004977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4005015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4005080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4005228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4006212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4006381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4006419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4006980 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4007403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4007554 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4007591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4007659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4007810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4008774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4008944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4008982 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4009513 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4009936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4010054 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4010092 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4010157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4010318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4011275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4011445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4011485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4012046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4012490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4012620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4012660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4012725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4012876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4013846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4014018 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4014059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4014600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4015042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4015161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4015198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4015266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4015417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4016392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4016565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4016602 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4017141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4017567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4017686 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4017723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4017791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4017961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4018952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4019125 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4019165 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4019696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4020122 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4020254 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4020291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4020356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4020504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4021450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4021620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4021660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4022205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4022625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4022744 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4022781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4022846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4022994 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4023981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4024153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4024191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4024754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4025204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4025323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4025360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4025428 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4025608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4026573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4026745 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4026783 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4027317 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4027742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4027872 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4027909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4027974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4028125 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4029076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4029243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4029284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4029850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4030273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4030391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4030429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4030494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4030655 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4031674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4031846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4031884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4032415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4032838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4032959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4032997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4033064 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4033226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4034180 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4034350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4034388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4034956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4035403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4035522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4035560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4035627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4035778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4036732 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SortServer2003Compat.nls</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4037109 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Globalization\Sorting\SortServer2003Compat.nls</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4037454 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SortServer2003Compat.nls</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4037495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SortServer2003Compat.nls</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 1,003,520, EndOfFile: 1,000,444, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4037581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SortServer2003Compat.nls</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4037681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Globalization\Sorting\SortServer2003Compat.nls</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4038702 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4038917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\CLRLoadLogDir</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4038982 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4039960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSCOREE.DLL.local</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4040203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4040370 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4040421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\InstallRoot</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4040456 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4041000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4041205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\*</Path>
<Result>SUCCESS</Result>
<Detail>Filter: *, 1: .</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4041682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\Microsoft.NET\Framework</Path>
<Result>SUCCESS</Result>
<Detail>0: .., 1: NETFXSBS10.exe, 2: netfxsbs12.hkf, 3: sbscmp10.dll, 4: sbscmp20_mscorwks.dll, 5: sbscmp20_perfcounter.dll, 6: sbs_diasymreader.dll, 7: sbs_iehost.dll, 8: sbs_microsoft.jscript.dll, 9: sbs_microsoft.vsa.vb.codedomprocessor.dll, 10: sbs_mscordbi.dll, 11: sbs_mscorrc.dll, 12: sbs_mscorsec.dll, 13: sbs_system.configuration.install.dll, 14: sbs_system.data.dll, 15: sbs_system.enterpriseservices.dll, 16: sbs_VsaVb7rt.dll, 17: sbs_wminet_utils.dll, 18: SharedReg12.dll, 19: v1.0.3705, 20: v1.1.4322, 21: v2.0.50727, 22: v3.0, 23: v3.5, 24: v4.0.30319</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4042647 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4043361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4044382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4045107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4045703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4046242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4046735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4047508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4047740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4048039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\Microsoft.NET\Framework</Path>
<Result>NO MORE FILES</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4048168 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4049111 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4049526 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4049979 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 292</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4050545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>END OF FILE</Result>
<Detail>Offset: 292, Length: 8,175</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4050777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4051087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4051265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\UseLegacyV2RuntimeActivationPolicyDefaultValue</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4051305 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4051424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4051558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\OnlyUseLatestCLR</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4051596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4052235 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4052566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 466,944, EndOfFile: 466,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4052633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4052679 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 466,944, EndOfFile: 466,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4052774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4053242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4053954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4054204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 466,944, EndOfFile: 466,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4054269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4054304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 466,944, EndOfFile: 466,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4054363 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4054716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4055113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4055280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\.NETFramework\Policy\Standards</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4055417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework\Policy\Standards</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4055590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\Standards\v4.0.30319</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4055692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\Standards</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4056015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4056207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NoClientChecks</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4056247 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4056333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework\v4.0.30319\SKUs\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4056503 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SKUs\default</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4056619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SKUs\Default</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4056662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SKUs</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4057206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Read Control, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4057449 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4058527 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4058691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/9/2011 6:30:10 AM, LastAccessTime: 10/11/2011 7:10:48 AM, LastWriteTime: 7/9/2011 6:30:10 AM, ChangeTime: 11/30/2011 11:57:40 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4058734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4059276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4059532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4059661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4069793 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4070295 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x5aa60000, Image Size: 0x66e000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4070392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4071448 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSVCR100_CLR0400.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4072337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MSVCR100_CLR0400.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4073194 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSVCR100_CLR0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4073372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 3/18/2010 10:16:28 AM, LastAccessTime: 10/10/2011 5:28:51 AM, LastWriteTime: 3/18/2010 10:16:28 AM, ChangeTime: 11/13/2011 6:56:32 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4073410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4073938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\MSVCR100_CLR0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4074180 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4074304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4074973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4075495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x64ed0000, Image Size: 0xbe000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4075636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4078104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4078298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4078352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4078915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4079384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4079519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4079562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4079645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4079810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4081003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4081187 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4081238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4081812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4082283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4082407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4082445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4082523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4082682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4083822 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4084008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4084046 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4084604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4085062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4085183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4085221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4085291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4085463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4086525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4086703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4086749 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4087309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4087743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4087872 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4087910 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4087975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4088123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4089257 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4089441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4089481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4090058 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4090494 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4090626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4090667 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4090756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4091033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4092149 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4092327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4092364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4092930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4093372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4093496 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4093534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4093607 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4093787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4095113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4095310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4095350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4096043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4096522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4096646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4096689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4096757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4096913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4097905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4098085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4098126 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4098683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4099125 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4099247 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4099287 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4099363 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4099524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4100537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4100713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4100753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4101314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4101745 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4101879 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4101920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4101990 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4102141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4103238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4103434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4103475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4104483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4105183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4105321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4105366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4105447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4105614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4106743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4106954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4106997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4107651 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4108107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4108228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4108269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4108339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4108498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4109527 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4109699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4109740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4110284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4110705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4110820 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4110861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4110928 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4111076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4112082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4112259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4112300 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4112866 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4113297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4113415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4113453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4113523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4113682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4114722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4114935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4114973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4115550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4115986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4116116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4116156 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4116231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4116407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4117388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4117560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4117600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4118172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4118616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4118738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4118775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4118848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4119007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4120282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4120486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4120527 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4121252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4121807 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4121942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4121995 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4122098 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4122297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4123405 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4123585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4123626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4124184 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4124623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4124758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4124801 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4124871 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4125027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4126062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4126240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4126280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4126851 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4127288 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4127417 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4127455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4127525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4127673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4128660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4128835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4128905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4129468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4129902 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4130020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4130058 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4130123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4130306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4131753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4131977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4132033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4132882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4133497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4133666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4133726 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4133831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4134049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4135491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4135709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4135752 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4136380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4136857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4137000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4137043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4137151 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4137312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4138366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4138544 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4138584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4139155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4139587 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4139708 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4139746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4139834 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4140004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4141055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4141233 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4141273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4141842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4142268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4142386 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4142424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4142489 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4142637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4143596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4143766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4143804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4144337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4144777 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4144898 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4144938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4145014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4145208 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4146407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4146666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4146784 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4147646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4148285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4148441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4148490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4148587 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4148811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4150285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4150506 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4150562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4151346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4151891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4152025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4152066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4152130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4152314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4156229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\.NETFramework</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4156404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4156658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\DisableConfigCache</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4156736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4156819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\.NETFramework</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4156895 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4157094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: InstallRoot, Type: REG_SZ, Length: 72, Data: C:\Windows\Microsoft.NET\Framework\</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4157167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 1, Length: 220</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4158522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\WMI\Security\e13c0d23-ccbc-4e12-931b-d9cc2eee27e4</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 524</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4159280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\WMI\Security\763fd754-7086-4dfe-95eb-c01a46faf4ca</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 524</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4159816 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\WMI\Security\a669021c-c450-4609-a035-5af59af4df18</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 524</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4160463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\WMI\Security\cc2bcbba-16b6-4cf3-8990-d74c2e8af500</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 524</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4161829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4162640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4163036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4163489 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,095</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4164270 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,095, Length: 6,135</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4164839 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 10,230, Length: 4,097</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4165221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 14,327, Length: 4,098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4165760 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 18,425, Length: 7,976</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4166536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4167164 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4167544 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4167854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 292</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4168293 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>END OF FILE</Result>
<Detail>Offset: 292, Length: 8,175</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4168474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4169053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4169366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MKV2AC3.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4170301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4170541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4170705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\CacheLocation</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4170746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4170859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4170993 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\DownloadCacheQuotaInKB</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Fusion</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171171 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\EnableLog</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\LoggingLevel</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\ForceLog</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\LogFailures</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\LogResourceBinds</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171322 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\FileInUseRetryAttempts</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\FileInUseMillisecondsBetweenRetries</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\UseLegacyIdentityFormat</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\DisableMSIPeek</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DevOverrideEnable</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4171799 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4175663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 3972</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4177086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4179706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 4572</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4180950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Globalization\Sorting\sortdefault.nls</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4181142 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Rpc</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: Read/Write, Delete, Write DAC</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4181339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Rpc\MaxRpcSize</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4181384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Globalization\Sorting\sortdefault.nls</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4181392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Rpc</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4181597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4181697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4181810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\sortdefault.nls</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4181842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName\ComputerName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 8, Data: TOM</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4181859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Globalization\Sorting\sortdefault.nls</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 2,945,024, EndOfFile: 2,944,004, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4181888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4181923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\Setup</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4181942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Globalization\Sorting\SortDefault.nls</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4182036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SYSTEM\Setup\OOBEInProgress</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4182050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Globalization\Sorting\sortdefault.nls</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4182077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SYSTEM\Setup</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4182155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\Setup</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4182271 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SYSTEM\Setup\SystemSetupInProgress</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4182309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SYSTEM\Setup</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4182395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\Windows NT\Rpc</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4182543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\SQMClient\Windows</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4182616 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\SQMClient\Windows</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4182745 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows\CEIPEnable</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4182802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\SQMClient\Windows</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4182858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4183066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\LatestIndex</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 281</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4183322 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4183629 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\LatestIndex</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 281</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4184165 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\index119.dat</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4185707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 2252</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4186003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index119</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4186281 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index119\NIUsageMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 15, Data: FF FF FF FF FF FF FF FF FF FF FF FF FF FF C1</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4186337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index119\ILUsageMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FD</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4186380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index119</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4186429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4186620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4186782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: 8</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4186828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 1, Length: 288</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4186863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 0, Length: 522</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4186919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 70, Data: mscorlib,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\ConfigMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4361</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\ConfigString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\MVID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: A7 74 BD 59 3B 84 20 BA E4 A8 CF 1D 46 AF 3B A2</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187728 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\EvalationData</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\ILDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 20, Data: 42 CA 99 14 51 56 91 00 08 00 00 00 04 00 00 00</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\NIDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187884 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\MissingDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4187914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4188027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4188194 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 70, Data: mscorlib,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4188347 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 8198</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4188391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8\Modules</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 126, Data: normidna.nlp|normnfc.nlp|normnfd.nlp|normnfkc.nlp|normnfkd.nlp</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4188450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 92 90 42 B2 63 59 29 4A 86 00 DB 4A E8 56 C9 D1</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4188490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: C4 39 8F BA 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4188528 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4188722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCreateKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion\GACChangeNotification\Default</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access, Disposition: REG_OPENED_EXISTING_KEY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4188965 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\mscorlib,4.0.0.0,,b77a5c561934e089,x86</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: C4 39 8F BA 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4191091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4192109 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:51 AM, LastAccessTime: 10/11/2011 7:10:51 AM, LastWriteTime: 10/11/2011 7:10:51 AM, ChangeTime: 11/13/2011 6:55:36 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4192150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4193659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4193847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:11:07 AM, LastAccessTime: 10/11/2011 7:11:07 AM, LastWriteTime: 10/11/2011 7:11:08 AM, ChangeTime: 11/13/2011 6:54:13 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4193891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4194432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\A774BD593B8420BAE4A8CF1D46AF3BA2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4194669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4201910 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4203362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x59c90000, Image Size: 0xdc1000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4203605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4204772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4204968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4205014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4205877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4206445 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4206637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4206704 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4206817 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4207051 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4208528 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4208798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4208857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4209598 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4210059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4210199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4210242 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4210312 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4210474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4211525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4211705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4211746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4212303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4212737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4212859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4212896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4212964 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4213117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4214155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4214400 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4214440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4215036 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4215475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4215610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4215650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4215718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4215879 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4216957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4217135 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4217176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4217763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4218200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4218321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4218364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4218431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4218585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4219593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4219819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4219862 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4220452 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4220897 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4221034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4221075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4221161 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4221323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4222409 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4222605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4222649 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4223236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4223718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4223856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4223899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4223966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4224149 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4225173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4225346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4225397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4225974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4226424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4226545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4226585 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4226653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4226817 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4227849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4228041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4228081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4228644 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4229086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4229224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4229264 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4229345 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4229504 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4230522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4230700 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4230743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4231315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4231749 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4231870 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4231910 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4231988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4232142 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4233126 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4233309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4233352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4233921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4234357 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4234476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4234516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4234594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4234759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4235834 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4236012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4236052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4236618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4237052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4237176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4237216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4237297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4237451 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4238429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4238601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4238650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4239197 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4239623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4239741 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4239782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4239860 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4240008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4241026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4241204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4241245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4241856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4242331 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4242455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4242495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4242565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4242746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4243942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4244136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4244179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4244786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4245249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4245397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4245440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4245527 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4245683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4246766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4246947 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4246987 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4247593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4248070 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4248197 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4248240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4248318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4248475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4249493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4249671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4249712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4250275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4250711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4250830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4250876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4250948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4251105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4252123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4252298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4252342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4252932 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4253379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4253498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4253538 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4253605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4253756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4254737 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4254920 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4254961 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4255519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4255966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4256101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4256138 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4256209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4256362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4257391 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4257572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4257626 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4258267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4258766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4258890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4258941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4259008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4259170 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4260232 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4260434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4260480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4261202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4261687 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4261832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4261873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4261975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4262180 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4263234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4263411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4263468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4264231 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4264694 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4264845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4264888 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4264966 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4265133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4266419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4266680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4266745 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4267572 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4268170 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4268367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4268418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4268529 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4268750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4270208 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4270455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4270526 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4271253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4271792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4271940 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4271994 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4272102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4272304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4273695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4274002 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4274072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4274972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4275462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4275597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4275648 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4275721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4275899 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4276931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4277109 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4277149 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4277715 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4278152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4278276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4278319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4278386 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4278542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4279612 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\StrongName</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4280887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4281083 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:51 AM, LastAccessTime: 10/11/2011 7:10:51 AM, LastWriteTime: 10/11/2011 7:10:51 AM, ChangeTime: 11/13/2011 6:55:36 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4281135 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4281671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4281754 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\index119.dat</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4283191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4283406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: mscorlib.INI</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4283587 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4286567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4286829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 4/5/2014 12:17:51 PM, LastAccessTime: 4/5/2014 12:17:51 PM, LastWriteTime: 4/5/2014 4:17:22 PM, ChangeTime: 4/5/2014 12:18:13 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4286891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4287715 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4287993 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MKV2AC3, 1: MKV2AC3</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4288276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4288944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4289154 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Filter: MKV2AC3.exe, 1: MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4289375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4290340 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4290510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 4/5/2014 12:17:51 PM, LastAccessTime: 4/5/2014 12:17:51 PM, LastWriteTime: 4/5/2014 4:17:22 PM, ChangeTime: 4/5/2014 12:18:13 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4290547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4290801 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4291005 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files</Path>
<Result>SUCCESS</Result>
<Detail>Filter: Program Files, 1: Program Files</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4291218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4292509 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4293649 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4294069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4294107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4294589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4295236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4295357 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4295395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 376,832, EndOfFile: 376,832, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4295468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4295662 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4296573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4296988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:53 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4297023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4297500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4298095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4298208 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4298246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 376,832, EndOfFile: 376,832, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4298313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4298491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\rpcss.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4299618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CRYPTBASE.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4300426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\CRYPTBASE.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4301267 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4301431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:12:01 PM, LastAccessTime: 7/13/2009 1:12:01 PM, LastWriteTime: 7/13/2009 3:15:07 PM, ChangeTime: 11/13/2011 6:56:15 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4301469 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4302180 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4302485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4302625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4302776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4305654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x75e30000, Image Size: 0xc000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4305751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\CRYPTBASE.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4307826 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4308125 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4308171 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4308812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4309284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4309418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4309461 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4309542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4309704 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4310812 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4311008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4311049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4311636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4312102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4312229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4312269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4312337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4312542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4313660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4313848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4313892 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4314468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4315002 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4315134 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4315177 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4315244 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4315398 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4316543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4316743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4316780 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4317354 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4317783 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4317901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4317942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4318006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4318160 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4319122 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4319297 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4319335 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4319860 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4320278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4320397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4320434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4320502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4320661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4321636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4321806 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4321844 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4322383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4322803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4322932 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4322970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4323035 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4323183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4324199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4324374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4324414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4325042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4325479 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4325597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4325638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4325703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4325853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4326896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4327080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4327117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4327667 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4328090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4328209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4328249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4328316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4328478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4329443 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4329613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4329653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4330219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4330661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4330790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4330828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4330893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4331052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4332003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4332175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4332213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4332757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4333180 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4333299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4333337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4333401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4333550 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4334525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4334695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4334743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4335307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4335748 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4335883 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4335921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4335988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4336150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4337139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4337311 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4337349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4337877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4338306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4338432 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4338473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4338537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4338686 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4339640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4339809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4339847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4340400 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4340823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4340938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4340976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4341041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4341189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4342240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4342415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4342453 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4342981 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4343401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4343520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4343558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4343622 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4343781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4344725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4344916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4344954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4345498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4345926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4346056 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4346104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4346174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4346366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4347352 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4347522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4347562 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4348120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4348546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4348664 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4348702 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4348767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4348918 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4349923 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4350090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4350130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4350658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4351084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4351200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4351238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4351302 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4351464 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4352421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4352593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4352631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4353175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4353612 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4353730 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4353768 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4353833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4353994 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4355040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4355215 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4355266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4355803 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4356228 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4356347 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4356385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4356449 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4356597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4357570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4357740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4357778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4358319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4358742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4358858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4358896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4358972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4359120 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4360103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4360273 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4360313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4360879 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4361319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4361434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4361472 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4361540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4361699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4362650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4362820 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4362868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4363402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4363822 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4363941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4363978 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4364043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4364191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4365199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4365401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4365485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4366107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4366554 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4366692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4366730 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4366808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4366959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4367942 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4368115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4368152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4368697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4369123 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4369238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4369276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4369341 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4369489 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4370438 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4370618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4370656 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4371303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4371747 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4371868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4371936 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4372006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4372178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4373369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4373577 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4373623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4374291 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4374889 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4375051 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4375113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4375204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4375390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4383313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4383499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/9/2011 6:30:10 AM, LastAccessTime: 10/11/2011 7:10:48 AM, LastWriteTime: 7/9/2011 6:30:10 AM, ChangeTime: 11/30/2011 11:57:40 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4383545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4384078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4384331 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4384461 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4384765 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4386134 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x71760000, Image Size: 0x10000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4386229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4387603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4387791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4387832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4388390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4388829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4388953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4388993 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4389063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4389222 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4390201 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4390373 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4390413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4390963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4391386 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4391505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4391543 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4391610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4391772 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4392755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4393359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4393402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4394006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4394456 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4394609 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4394652 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4394725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4394895 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4396000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4396204 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4396248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4396873 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4397333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4397460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4397501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4397587 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4397746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4398829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4399015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4399063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4399678 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4400149 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4400276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4400325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4400411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4400618 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4401750 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4401931 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4401971 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4402529 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4402963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4403087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4403127 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4403197 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4403351 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4404356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4404534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4404574 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4405151 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4405595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4405719 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4405757 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4405827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4405989 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4407059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4407234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4407272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4407811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4408234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4408366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4408403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4408471 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4408635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4409646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4409829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4409869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4410430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4410866 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4410988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4411028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4411109 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4411262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4412249 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4412421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4412462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4413052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4413478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4413596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4413637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4413701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4413852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4414836 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4415014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4415051 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4415587 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4416008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4416126 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4416167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4416234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4416415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4417498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4417673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4417711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4418255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4418678 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4418810 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4418848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4418915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4419066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4420101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4420274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4420314 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4420856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4421276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4421395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4421435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4421502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4421653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4422615 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4422785 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4422823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4423362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4423782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4423901 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4423938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4424006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4424170 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4425146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4425315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4425356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4425911 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4426369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4426490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4426528 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4426595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4426746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4427727 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4427900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4427951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4428484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4428910 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4429029 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4429066 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4429134 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4429282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4430255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4430425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4430465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4431007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4431435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4431554 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4431591 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4431670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4431831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4432850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4433025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4433065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4433604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4434038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4434157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4434208 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4434278 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4434464 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4435474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4435658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4435698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4436237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4436660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4436781 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4436819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4436887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4437040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4438072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4438245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4438285 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4438840 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4439266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4439385 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4439425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4439503 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4439654 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4440605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4440778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4440815 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4441365 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4441788 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4441907 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4441945 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4442012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4442171 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4443173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4443343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4443383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4443957 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4444381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4444518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4444556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4444623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4444787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4445758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4445927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4445968 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4446507 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4446930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4447062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4447100 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4447167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4447318 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4448274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4448444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4448485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4449056 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4449482 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4449600 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4449638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4449705 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4449854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4450840 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4451010 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4451047 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4451602 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4452025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4452144 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4452182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4452252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4452413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4453367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4453537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4453578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4454117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4454540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4454669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4454707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4454790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4454952 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4455997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4456383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4456712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4456752 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 2,957,312, EndOfFile: 2,956,620, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4456819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4456922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4462575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.Config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4462756 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 2/23/2007 6:15:02 PM, LastAccessTime: 4/5/2014 12:16:43 PM, LastWriteTime: 2/23/2007 6:15:02 PM, ChangeTime: 4/5/2014 12:16:43 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4462794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4463855 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4464028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 4/5/2014 12:17:51 PM, LastAccessTime: 4/5/2014 12:17:51 PM, LastWriteTime: 4/5/2014 4:17:22 PM, ChangeTime: 4/5/2014 12:18:13 PM, AllocationSize: 466944, EndOfFile: 466432, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4464068 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4464483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4464720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\LatestIndex</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 281</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4464982 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4465130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\LatestIndex</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 281</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4465620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\index119.dat</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4465917 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index119</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4466095 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index119\NIUsageMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 15, Data: FF FF FF FF FF FF FF FF FF FF FF FF FF FF C1</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4466146 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index119\ILUsageMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FD</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4466189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\index119</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4466235 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4466364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\a43ba77\19470c78</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4466518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\a43ba77\19470c78</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4467283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4467488 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: MKV2AC3.INI</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4467674 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4470762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4471029 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 466,944, EndOfFile: 466,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4471099 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4471142 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 466,944, EndOfFile: 466,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4471212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4471875 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4473909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Fusion\PublisherPolicy\Default</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4474106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\Latest</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4474637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\pubpol4.dat</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4476143 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\index4</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 1, Data: FF</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4476237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\LegacyPolicyTimeStamp</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 00 00 00 00 00 00 00 00</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4477614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\GAC\PublisherPolicy.tme</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4478614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.Config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4478792 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 2/23/2007 6:15:02 PM, LastAccessTime: 4/5/2014 12:16:43 PM, LastWriteTime: 2/23/2007 6:15:02 PM, ChangeTime: 4/5/2014 12:16:43 PM, AllocationSize: 296, EndOfFile: 292, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4478835 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4479552 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.Config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4479935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4480320 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 292</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4480859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>END OF FILE</Result>
<Detail>Offset: 292, Length: 8,175</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4481139 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe.config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4482195 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4482381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNetworkOpenInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 3/17/2010 9:13:36 PM, LastAccessTime: 10/10/2011 5:28:51 AM, LastWriteTime: 3/17/2010 9:13:36 PM, ChangeTime: 11/30/2011 11:57:40 AM, AllocationSize: 36864, EndOfFile: 35955, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4482425 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4483093 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4483500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4483842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 0, Length: 4,095</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4484726 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 4,095, Length: 6,135</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4485354 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 10,230, Length: 4,097</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4485774 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 14,327, Length: 4,098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4486353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 18,425, Length: 7,976</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4487299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4488027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4488162 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4488461 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4488663 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47</Path>
<Result>SUCCESS</Result>
<Detail>Index: 0, Name: 4c</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4488722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 1, Length: 288</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4488765 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegEnumValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47</Path>
<Result>NO MORE ENTRIES</Result>
<Detail>Index: 0, Length: 522</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4488833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4488954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 98, Data: Microsoft.VisualBasic,10.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c\ConfigMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4361</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c\ConfigString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489307 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c\MVID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: C9 04 6D A3 45 00 2C 67 F6 48 74 CD 25 4E 99 D8</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489477 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c\EvalationData</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489652 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489700 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c\ILDependencies</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c\ILDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 300, Data: E2 F7 E1 27 0B 79 43 6C 0C 00 00 00 04 00 00 00</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c\NIDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 120, Data: C6 38 19 18 42 CA 99 14 08 00 00 00 04 00 00 00</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c\MissingDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4489951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\1c22df2f\6ae28f47\4c</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4490069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\6c43790b\c</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4490234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\6c43790b\c\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 94, Data: System.Windows.Forms,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4490414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\6c43790b\c\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4490460 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\6c43790b\c\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4490493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\6c43790b\c\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: A7 32 87 50 70 EC AD 4F 8D 2B 0C C3 ED 82 E7 2D</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4490533 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\6c43790b\c\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: F2 1C 55 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4490571 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\27e1f7e2\6c43790b\c</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4490722 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\3</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4490881 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\3\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 82, Data: System.Drawing,4.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4490986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\3\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491026 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\3\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491058 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\3\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 08 15 1E 88 E0 59 DB 47 A1 43 98 2F 9A D0 99 A8</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491093 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\3\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 6E 45 3D BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491131 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\910bc3f\306db89e\3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\58364143\24da33f5\b</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\58364143\24da33f5\b\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 88, Data: System.Deployment,4.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491492 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\58364143\24da33f5\b\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491533 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\58364143\24da33f5\b\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\58364143\24da33f5\b\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 30 A1 E4 CA BB CF A6 43 B2 C1 DB 43 33 97 51 9B</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\58364143\24da33f5\b\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 58 6F 06 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\58364143\24da33f5\b</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1dfa8c62\5766bfaf\2c</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4491958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1dfa8c62\5766bfaf\2c\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 88, Data: System.Management,4.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492045 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1dfa8c62\5766bfaf\2c\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1dfa8c62\5766bfaf\2c\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1dfa8c62\5766bfaf\2c\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 25 A3 A0 85 CE DD B3 4B BD 88 A1 8A 12 75 56 8F</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1dfa8c62\5766bfaf\2c\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 7C 6C 44 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492193 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1dfa8c62\5766bfaf\2c</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\3d37e654\7e3a5608\48</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\3d37e654\7e3a5608\48\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 84, Data: System.Xml.Linq,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492554 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\3d37e654\7e3a5608\48\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492592 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\3d37e654\7e3a5608\48\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\3d37e654\7e3a5608\48\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 54 9A 81 D8 44 AD 37 40 83 B2 63 3A 74 14 08 E3</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492675 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\3d37e654\7e3a5608\48\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 0A 2A E4 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492729 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\3d37e654\7e3a5608\48</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4492934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\3d7dc7a\5</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493104 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\3d7dc7a\5\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 74, Data: System.Xml,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493195 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\3d7dc7a\5\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\3d7dc7a\5\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\3d7dc7a\5\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: C7 0A 2D C6 3D 31 46 44 9E F6 01 88 46 13 7C 3A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\3d7dc7a\5\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 76 F4 6C BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\34f474d5\3d7dc7a\5</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\2ab76b15\635d73e9\47</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\2ab76b15\635d73e9\47\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 100, Data: System.Runtime.Remoting,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\2ab76b15\635d73e9\47\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\2ab76b15\635d73e9\47\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\2ab76b15\635d73e9\47\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 5A CE 1F DC 8B 79 B8 42 BC 56 ED 88 B0 1A 60 F7</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\2ab76b15\635d73e9\47\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 76 21 9E BC 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4493953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\2ab76b15\635d73e9\47</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4494303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\6ae28f47\f854f2d\33</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4494467 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\6ae28f47\f854f2d\33\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 98, Data: Microsoft.VisualBasic,10.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4494553 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\6ae28f47\f854f2d\33\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4494594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\6ae28f47\f854f2d\33\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4494624 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\6ae28f47\f854f2d\33\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 80 97 8D 64 B2 12 8D 4D AC 99 B0 A7 02 0E BF 76</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4494661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\6ae28f47\f854f2d\33\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 42 99 CF BA 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4494699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\6ae28f47\f854f2d\33</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4494861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 70, Data: mscorlib,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495087 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\ConfigMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4361</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\ConfigString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\MVID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: A7 74 BD 59 3B 84 20 BA E4 A8 CF 1D 46 AF 3B A2</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495224 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\EvalationData</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495254 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\ILDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 20, Data: 42 CA 99 14 51 56 91 00 08 00 00 00 04 00 00 00</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\NIDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495418 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8\MissingDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495451 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\181938c6\1499ca42\8</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495556 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495707 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 70, Data: mscorlib,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495782 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 8198</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8\Modules</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 126, Data: normidna.nlp|normnfc.nlp|normnfd.nlp|normnfkc.nlp|normnfkd.nlp</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 92 90 42 B2 63 59 29 4A 86 00 DB 4A E8 56 C9 D1</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: C4 39 8F BA 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4495960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\1499ca42\915651\8</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4496240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\6</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4496399 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\6\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: System,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4496483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\6\ConfigMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4361</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4496526 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\6\ConfigString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4496569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\6\MVID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: 52 86 FE 2D 01 67 EB 83 5A 9F 11 02 5F 1C B7 56</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4496615 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\6\EvalationData</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4496647 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\6\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4496704 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\6\ILDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 100, Data: 56 BC 94 5D EF 0C 15 3B 04 00 00 00 04 00 00 00</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4496771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\6\NIDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 40, Data: C6 38 19 18 42 CA 99 14 08 00 00 00 04 00 00 00</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4496828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\6\MissingDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4496863 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\30bc7c4f\5a99e5cd\6</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4496963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\4</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\4\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 94, Data: System.Configuration,4.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497192 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\4\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\4\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\4\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 15 FA 5D 27 66 C5 7D 40 89 3A 33 EF 21 DB 2C EF</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\4\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 5E E7 DD BA 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5d94bc56\3b150cef\4</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5a99e5cd\7664314e\6</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5a99e5cd\7664314e\6\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 66, Data: System,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5a99e5cd\7664314e\6\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5a99e5cd\7664314e\6\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5a99e5cd\7664314e\6\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 99 1B 4C D8 9F 1F 43 42 AE 40 68 1D 99 AD 81 80</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5a99e5cd\7664314e\6\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 06 BC 33 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4497927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\5a99e5cd\7664314e\6</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4498221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\4</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4498383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\4\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 76, Data: System.Core,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4498466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\4\ConfigMask</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4361</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4498515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\4\ConfigString</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 2, Data: </Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4498558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\4\MVID</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 16, Data: 44 A7 D2 59 79 81 A8 2D A8 B9 E3 E2 29 86 02 DE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4498604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\4\EvalationData</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4498636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\4\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4498676 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\4\ILDependencies</Path>
<Result>BUFFER OVERFLOW</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4498711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\4\ILDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 140, Data: BE B5 A6 62 26 07 04 32 01 00 00 00 04 00 00 00</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4498776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\4\NIDependencies</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 80, Data: C6 38 19 18 42 CA 99 14 08 00 00 00 04 00 00 00</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4498868 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\4\MissingDependencies</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4498905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\NI\7ac727df\4c76d55c\4</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4499040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\62a6b5be\32040726\1</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4499218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\62a6b5be\32040726\1\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 84, Data: System.Security,4.0.0.0,,b03f5f7f11d50a3a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4499299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\62a6b5be\32040726\1\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4499339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\62a6b5be\32040726\1\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4499369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\62a6b5be\32040726\1\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: 1D 17 5E FD 3B A1 91 43 8D EC 65 14 F0 10 65 8C</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4499444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\62a6b5be\32040726\1\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 30 31 49 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4499485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\62a6b5be\32040726\1</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4499660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\77165922\6b6524e6\7</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4499849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\77165922\6b6524e6\7\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 84, Data: System.Numerics,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4499927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\77165922\6b6524e6\7\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4499967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\77165922\6b6524e6\7\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4499997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\77165922\6b6524e6\7\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: F7 6F CA 93 B4 81 FF 4D 9E 29 A5 BC B2 71 50 4C</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4500035 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\77165922\6b6524e6\7\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 48 3E D8 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4500072 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\77165922\6b6524e6\7</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4500266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c76d55c\555095f9\2</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Maximum Allowed, Granted Access: All Access</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4500412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c76d55c\555095f9\2\DisplayName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 76, Data: System.Core,4.0.0.0,,b77a5c561934e089</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4500487 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c76d55c\555095f9\2\Status</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 4098</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4500525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c76d55c\555095f9\2\Modules</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 144</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4500557 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c76d55c\555095f9\2\SIG</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 36, Data: B4 81 1A F4 8C 2D BF 4E A2 6F 33 AD 20 A4 8B 9E</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4500595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c76d55c\555095f9\2\LastModTime</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 62 55 8E BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4500633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32\IL\4c76d55c\555095f9\2</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4502212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4502341 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.10.0.Microsoft.VisualBasic__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4502522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\Microsoft.VisualBasic,10.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 42 99 CF BA 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4504828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4506472 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:52 AM, LastAccessTime: 10/11/2011 7:10:52 AM, LastWriteTime: 10/11/2011 7:10:52 AM, ChangeTime: 11/13/2011 6:55:36 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4506515 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4507173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4507294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4507631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4507733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4507895 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System,4.0.0.0,,b77a5c561934e089,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 06 BC 33 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4509954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4512263 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:52 AM, LastAccessTime: 10/11/2011 7:10:52 AM, LastWriteTime: 10/11/2011 7:10:52 AM, ChangeTime: 11/13/2011 6:55:37 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4512304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4512904 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4513031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4513387 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Configuration__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4513497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Configuration__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4513678 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Configuration,4.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 5E E7 DD BA 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4515734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4517316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:52 AM, LastAccessTime: 10/11/2011 7:10:52 AM, LastWriteTime: 10/11/2011 7:10:52 AM, ChangeTime: 11/13/2011 6:55:38 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4517364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4518030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4518154 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4518458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4518569 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4518739 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml,4.0.0.0,,b77a5c561934e089,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 76 F4 6C BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4520916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4522630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:53 AM, LastAccessTime: 10/11/2011 7:10:53 AM, LastWriteTime: 10/11/2011 7:10:53 AM, ChangeTime: 11/13/2011 6:55:40 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4522670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4524516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4524702 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:11:12 AM, LastAccessTime: 10/11/2011 7:11:12 AM, LastWriteTime: 10/11/2011 7:11:12 AM, ChangeTime: 11/13/2011 6:54:16 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4524767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4525324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM\5286FE2D0167EB835A9F11025F1CB756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4525578 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4528084 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4528623 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x593e0000, Image Size: 0x8ad000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4528828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4529887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4530067 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4530108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4530676 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4531113 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4531239 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4531280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4531350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4531530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4532503 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4532676 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4532716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4533279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4533718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4533837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4533877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4533958 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4534115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4535122 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4535298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4535349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4535915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4536362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4536497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4536537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4536604 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4536758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4537823 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4537998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4538041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4538615 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4539076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4539200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4539240 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4539313 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4539466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4540447 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4540625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4540665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4541258 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4541695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4541824 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4541865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4541935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4542091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4543091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4543269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4543320 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4543902 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4544344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4544465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4544519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4544608 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4544778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4545802 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4546020 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4546063 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4546648 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4547082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4547203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4547251 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4547321 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4547486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4548542 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4548736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4548779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4549375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4549827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4549951 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4549992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4550059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4550213 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4551272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4551450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4551490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4552034 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4552463 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4552584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4552622 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4552692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4552846 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4553840 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4554012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4554053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4554594 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4555055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4555185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4555225 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4555292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4555446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4556430 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4556599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4556640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4557206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4557631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4557753 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4557790 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4557858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4558011 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4559003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4559175 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4559216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4560251 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4560695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4560814 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4560854 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4560924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4561086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4562088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4562261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4562301 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4562859 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4563309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4563476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4563519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4563589 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4563762 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4564740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4564934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4564974 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4565551 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4565982 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4566101 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4566141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4566209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4566362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4567359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4567537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4567575 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4568117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4568561 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4568680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4568720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4568787 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4568963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4569944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4570116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4570156 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4570693 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4571140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4571269 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4571310 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4571377 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4571541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4572498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4572671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4572719 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4573277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4573700 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4573819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4573856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4573924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4574077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4575085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4575263 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4575303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4575842 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4576268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4576387 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4576427 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4576505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4576659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4577613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4577785 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4577826 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4578383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4578820 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4578938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4578992 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4579062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4579216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4580197 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4580369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4580421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4580976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4581401 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4581520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4581558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4581625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4581779 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4582765 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4582937 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4582978 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4583514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4583934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4584053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4584093 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4584172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4584323 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4585325 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4585497 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4585538 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4586088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4586516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4586635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4586675 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4586742 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4586896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4587853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4588033 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4588074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4588631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4589057 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4589176 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4589216 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4589284 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4589437 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4590423 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4590596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4590636 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4591173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4591596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4591714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4591755 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4591830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4591984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4592935 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4593107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4593145 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4593692 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4594118 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4594253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4594290 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4594360 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4594530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4595527 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4595710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4595751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4596309 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4596734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4596856 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4596896 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4596963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4597114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4598260 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4598392 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4598685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Core__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4598785 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Core__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4598949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Core,4.0.0.0,,b77a5c561934e089,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 62 55 8E BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4600949 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4602493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:53 AM, LastAccessTime: 10/11/2011 7:10:53 AM, LastWriteTime: 10/11/2011 7:10:53 AM, ChangeTime: 11/13/2011 6:55:38 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4602536 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4603681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4603808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4604091 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Security__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4604193 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Security__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4604355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Security,4.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 30 31 49 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4606390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4607926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:52 AM, LastAccessTime: 10/11/2011 7:10:52 AM, LastWriteTime: 10/11/2011 7:10:52 AM, ChangeTime: 11/13/2011 6:55:39 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4607969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4608885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4609012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4609294 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Numerics__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4609397 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Numerics__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4609561 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Numerics,4.0.0.0,,b77a5c561934e089,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 48 3E D8 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4611534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4613064 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:53 AM, LastAccessTime: 10/11/2011 7:10:53 AM, LastWriteTime: 10/11/2011 7:10:53 AM, ChangeTime: 11/13/2011 6:55:39 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4613107 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4615085 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4615266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:11:17 AM, LastAccessTime: 10/11/2011 7:11:17 AM, LastWriteTime: 10/11/2011 7:11:17 AM, ChangeTime: 11/13/2011 6:54:17 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4615306 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4615861 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\44A7D2597981A82DA8B9E3E2298602DE\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4616096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4618435 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4618907 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x58d20000, Image Size: 0x6c0000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4619133 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4620262 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4620451 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4620491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4621041 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4621483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4621620 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4621661 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4621733 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4621890 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4622857 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4623029 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4623067 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4623641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4624086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4624207 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4624245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4624315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4624468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4625465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4625638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4625689 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4626244 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4626670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4626805 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4626845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4626913 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4627074 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4628039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4628211 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4628252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4628804 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4629243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4629362 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4629402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4629473 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4629629 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4630647 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4630825 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4630866 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4631434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4631865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4631984 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4632024 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4632094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4632248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4633253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4633450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4633490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4634083 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4634522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4634644 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4634684 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4634765 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4634929 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4636234 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4636422 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4636465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4637031 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4637468 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4637619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4637686 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4637786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4637950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4638969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4639155 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4639195 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4639734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4640157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4640276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4640316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4640383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4640537 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4641523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4641696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4641736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4642289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4642717 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4642836 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4642876 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4642954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4643108 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4644064 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4644237 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4644277 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4644878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4645315 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4645436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4645476 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4645544 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4645697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4646657 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4646837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4646878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4647441 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4647869 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4648004 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4648044 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4648112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4648265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4649227 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4649400 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4649440 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4649977 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4650400 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4650518 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4650559 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4650637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4650788 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4651760 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4651930 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4651971 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4652520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4652943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4653062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4653102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4653167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4653350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4654353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4654525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4654566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4655132 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4655560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4655679 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4655716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4655786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4655948 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4656953 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4657128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4657169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4657708 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4658134 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4658252 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4658303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4658371 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4658524 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4659500 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4659672 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4659713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4660276 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4660699 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4660817 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4660858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4660925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4661079 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4662049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4662221 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4662259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4662830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4663253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4663375 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4663412 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4663483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4663633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4664593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4664776 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4664819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4665374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4665797 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4665919 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4665967 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4666037 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4666191 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4667163 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4667336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4667376 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4667926 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4668349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4668470 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4668508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4668576 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4668748 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4670268 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4670516 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4670586 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4671443 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4672062 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4672251 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4672302 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4672399 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4672628 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4674218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4674442 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4674485 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4675102 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4675558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4675687 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4675727 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4675800 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4675978 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4677015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4677196 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4677236 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4677808 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4678255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4678374 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4678414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4678481 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4678635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4679645 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4679818 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4679858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4680395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4681014 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4681198 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4681243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4681319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4681478 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4682510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4682685 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4682725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4683275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4683706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4683828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4683865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4683933 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4684100 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4685137 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4685339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4685380 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4685986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4686423 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4686563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4686603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4686673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4686838 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4687916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4688112 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4688153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4688767 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4689212 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4689344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4689384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4689451 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4689605 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4691475 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4691615 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4692003 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Windows.Forms__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4692119 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Windows.Forms__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4692292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Windows.Forms,4.0.0.0,,b77a5c561934e089,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: F2 1C 55 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4694367 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4695954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:52 AM, LastAccessTime: 10/11/2011 7:10:52 AM, LastWriteTime: 10/11/2011 7:10:52 AM, ChangeTime: 11/13/2011 6:55:40 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4695997 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4696671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4696795 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4697080 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Drawing__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4697183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Drawing__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4697414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Drawing,4.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 6E 45 3D BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4699414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4700947 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:52 AM, LastAccessTime: 10/11/2011 7:10:52 AM, LastWriteTime: 10/11/2011 7:10:52 AM, ChangeTime: 11/13/2011 6:55:39 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4700988 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4701723 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4701853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4702214 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Deployment__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4702319 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Deployment__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4702486 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Deployment,4.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 58 6F 06 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4704421 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4705975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:52 AM, LastAccessTime: 10/11/2011 7:10:52 AM, LastWriteTime: 10/11/2011 7:10:52 AM, ChangeTime: 11/13/2011 6:55:39 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4706016 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Deployment\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4706660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4706789 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4707078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Management__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4707183 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Management__b03f5f7f11d50a3a</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4707344 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Management,4.0.0.0,,b03f5f7f11d50a3a,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 7C 6C 44 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4709303 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4710850 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:52 AM, LastAccessTime: 10/11/2011 7:10:52 AM, LastWriteTime: 10/11/2011 7:10:52 AM, ChangeTime: 11/13/2011 6:55:39 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4710893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4711610 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4711734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4712076 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Xml.Linq__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4712181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Xml.Linq__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4712346 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Xml.Linq,4.0.0.0,,b77a5c561934e089,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 0A 2A E4 BB 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4714356 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4716000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:53 AM, LastAccessTime: 10/11/2011 7:10:53 AM, LastWriteTime: 10/11/2011 7:10:53 AM, ChangeTime: 11/13/2011 6:55:40 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4716043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.Linq\v4.0_4.0.0.0__b77a5c561934e089\System.Xml.Linq.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4716921 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4717053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4717347 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\v4.0_policy.4.0.System.Runtime.Remoting__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4717455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default\policy.4.0.System.Runtime.Remoting__b77a5c561934e089</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4717619 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default\System.Runtime.Remoting,4.0.0.0,,b77a5c561934e089,MSIL</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_BINARY, Length: 8, Data: 76 21 9E BC 38 88 CC 01</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4719681 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4721217 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 10/11/2011 7:10:55 AM, LastAccessTime: 10/11/2011 7:10:55 AM, LastWriteTime: 10/11/2011 7:10:55 AM, ChangeTime: 11/13/2011 6:55:39 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4721257 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4723631 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4723817 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 12/1/2011 2:03:02 PM, LastAccessTime: 12/1/2011 2:03:02 PM, LastWriteTime: 12/1/2011 2:03:02 PM, ChangeTime: 12/1/2011 2:03:02 PM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4723858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4724410 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.VISUALBAS#\C9046DA345002C67F64874CD254E99D8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4724666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4725499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4726000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0x58b70000, Image Size: 0x1ab000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4726226 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4727342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4727525 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4727566 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4728131 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4728571 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4728695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4728735 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4728805 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4728972 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4729956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4730128 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4730169 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4730713 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4731150 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4731271 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4731311 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4731379 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4731540 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4732521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4732696 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4732745 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4733308 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4733734 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4733852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4733893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4733960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4734114 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4735197 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4735372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4735413 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4735976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4736404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4736523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4736563 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4736641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4736795 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4737773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4737943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4737983 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4738520 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4738956 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4739075 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4739115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4739182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4739336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4740349 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4740522 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4740573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4741115 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4741538 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4741659 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4741697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4741775 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4741934 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4742944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4743117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4743157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4743718 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4744152 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4744275 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4744316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4744386 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4744545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4745596 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4745771 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4745814 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4746407 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4746849 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4746973 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4747011 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4747081 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4747248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4748272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4748450 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4748490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4749051 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4749474 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4749595 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4749633 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4749703 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4749864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4750878 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4751050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4751090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4751627 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4752050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4752171 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4752209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4752279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4752443 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4753424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4753597 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4753637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4754214 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4754642 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4754785 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4754828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4754898 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4755052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4756030 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4756202 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4756243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4756801 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4757229 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4757350 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4757388 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4757458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4757612 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4758601 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4758773 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4758813 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4759361 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4759786 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4759905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4759943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4760013 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4760174 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4761182 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4761355 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4761395 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4761950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4762387 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4762508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4762546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4762613 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4762764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4763721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4763893 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4763944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4764499 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4764944 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4765065 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4765106 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4765173 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4765327 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4766324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4766496 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4766534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4767094 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4767523 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4767641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4767682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4767760 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4767914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4768894 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4769067 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4769105 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4769641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4770077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4770215 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4770253 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4770333 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4770490 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4771449 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4771630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4771673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4772206 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4772632 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4772751 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4772791 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4772858 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4773023 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4774025 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4774200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4774241 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4774828 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4775265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4775383 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4775424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4775505 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4775658 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4776639 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4776811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4776852 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4777404 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4777827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4777946 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4777986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4778054 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4778205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4779218 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4779390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4779431 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4779970 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4780414 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4780533 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4780573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4780641 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4780794 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4781778 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4781950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4781991 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4782527 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4782950 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4783069 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4783117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4783185 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4783338 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4784292 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4784462 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4784502 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4785103 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4785532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4785650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4785688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4785758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4785909 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4786941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4787116 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4787157 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4787695 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4788143 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4788261 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4788299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4788369 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4788534 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4789501 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4789671 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4789711 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4790255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4790697 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4790819 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4790867 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4790937 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4791088 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4792082 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4792255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 11/20/2010 11:29:12 AM, LastAccessTime: 11/20/2010 11:29:12 AM, LastWriteTime: 11/20/2010 11:29:12 AM, ChangeTime: 11/13/2011 6:56:14 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4792295 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4792864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.DLL</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4793290 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4793411 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4793449 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 532,480, EndOfFile: 530,432, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4793519 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4793670 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4797682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4799038 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: Microsoft.VisualBasic.INI</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4799614 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4800000 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework\Policy\APTCA</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Maximum Allowed</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4802764 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4804163 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: System.INI</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4805028 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4807833 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4809162 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: System.Core.INI</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4809725 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4817200 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4817437 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: System.INI</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4817593 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4821959 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4822172 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: System.Core.INI</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4822339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4823465 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4823678 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.INI</Path>
<Result>NO SUCH FILE</Result>
<Detail>Filter: System.INI</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4823832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4832581 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4833446 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll.DLL</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4834190 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4834826 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll.DLL</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4835837 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4836049 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 3/18/2010 10:16:28 AM, LastAccessTime: 10/10/2011 5:28:51 AM, LastWriteTime: 3/18/2010 10:16:28 AM, ChangeTime: 11/30/2011 11:57:40 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4836109 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4836688 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4837090 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4837246 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4837289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 372,736, EndOfFile: 372,048, NumberOfLinks: 1, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4837359 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4837491 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4838243 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Locale</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4838343 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Locale</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4838545 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4838599 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4838720 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Language Groups</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4838768 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Language Groups</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4838882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Locale\00000409</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4838925 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Language Groups\1</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 4, Data: 1</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4841900 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4841986 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4842140 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4842263 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName\ComputerName</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 8, Data: TOM</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4842304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4842342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\Setup</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4842444 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SYSTEM\Setup\OOBEInProgress</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4842484 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SYSTEM\Setup</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4842517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\Setup</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4842603 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SYSTEM\Setup\SystemSetupInProgress</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4842638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SYSTEM\Setup</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4842665 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\ComputerName</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4845740 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4847168 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\system32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4847381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 4:37:07 PM, LastAccessTime: 4/5/2014 12:50:27 AM, LastWriteTime: 4/5/2014 12:50:27 AM, ChangeTime: 4/5/2014 12:50:27 AM, FileAttributes: D</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4847429 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4848119 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4848669 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4848795 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4849469 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4849617 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WerFault.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value, Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4850189 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\WerFault.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4851684 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Process Create</Operation>
<Path>C:\Windows\system32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>PID: 4388, Command line: C:\Windows\system32\WerFault.exe -u -p 1164 -s 644</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4851832 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4851916 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\AppCertDlls</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852021 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\SafeBoot\Option</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value, Set Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\SafeBoot\Option</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value, Set Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852129 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852272 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 80</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852304 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\AuthenticodeEnabled</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_DWORD, Length: 4, Data: 0</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852339 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852439 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852541 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\SafeBoot\Option</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\SafeBoot\Option</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility</Path>
<Result>REPARSE</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852679 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatibility</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852738 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Policies\Microsoft\Windows\AppCompat</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852816 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QuerySecurityFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>Information: Owner, Group, DACL, SACL, Label</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4852894 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:27:32 PM, LastAccessTime: 7/13/2009 1:27:32 PM, LastWriteTime: 7/13/2009 3:14:44 PM, ChangeTime: 11/13/2011 6:57:01 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4853007 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4853156 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4853298 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Windows\system32\WerFault.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 16</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4853341 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4853382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4853514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\WerFault.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4854039 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Load Image</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>Image Base: 0xe50000, Image Size: 0x5b000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4854549 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4855230 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4855457 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4855530 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4855567 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4855635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4855721 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4856324 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\system32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4856532 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>Filter: WerFault.exe, 1: WerFault.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4856758 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4858761 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4859181 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:27:32 PM, LastAccessTime: 7/13/2009 1:27:32 PM, LastWriteTime: 7/13/2009 3:14:44 PM, ChangeTime: 11/13/2011 6:57:01 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4859219 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4859496 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4859701 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows</Path>
<Result>SUCCESS</Result>
<Detail>Filter: Windows, 1: Windows</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4859922 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4860458 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4860666 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\system32</Path>
<Result>SUCCESS</Result>
<Detail>Filter: system32, 1: System32</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4860881 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4861415 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\system32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4861612 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>Filter: WerFault.exe, 1: WerFault.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4861827 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4862110 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4862320 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Cache</Path>
<Result>SUCCESS</Result>
<Detail>Type: REG_SZ, Length: 146, Data: C:\Users\manono\AppData\Local\Microsoft\Windows\Temporary Internet Files</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4862390 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4862436 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4862584 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Windows\System32\WerFault.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 1,024</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4862630 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4862706 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4862830 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers\C:\Windows\System32\WerFault.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 1,024</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4862865 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4862908 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Custom\WerFault.exe</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4863829 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\system32</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4864050 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32\*</Path>
<Result>SUCCESS</Result>
<Detail>Filter: *, 1: .</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4864290 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: .., 1: 0409, 2: 12520437.cpx, 3: 12520850.cpx, 4: 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0, 5: 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0, 6: aaclient.dll, 7: ac3filter.acm, 8: accessibilitycpl.dll, 9: ACCTRES.dll, 10: acledit.dll, 11: aclui.dll, 12: acppage.dll, 13: acproxy.dll, 14: ActionCenter.dll, 15: ActionCenterCPL.dll, 16: ActionQueue.dll, 17: activeds.dll, 18: activeds.tlb, 19: actxprxy.dll, 20: AdapterTroubleshooter.exe, 21: admparse.dll, 22: AdmTmpl.dll, 23: adprovider.dll, 24: adsldp.dll, 25: adsldpc.dll, 26: adsmsext.dll, 27: adsnt.dll, 28: adtschema.dll, 29: AdvancedInstallers, 30: advapi32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4864770 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: advpack.dll, 1: aecache.dll, 2: aeevts.dll, 3: aeinv.dll, 4: aelupsvc.dll, 5: aepdu.dll, 6: aepic.dll, 7: aitagent.exe, 8: alg.exe, 9: AltTab.dll, 10: amcompat.tlb, 11: amdocl.dll, 12: amdpcom32.dll, 13: amstream.dll, 14: amxread.dll, 15: ANSI.SYS, 16: apds.dll, 17: api-ms-win-core-console-l1-1-0.dll, 18: api-ms-win-core-datetime-l1-1-0.dll, 19: api-ms-win-core-debug-l1-1-0.dll, 20: api-ms-win-core-delayload-l1-1-0.dll, 21: api-ms-win-core-errorhandling-l1-1-0.dll, 22: api-ms-win-core-fibers-l1-1-0.dll, 23: api-ms-win-core-file-l1-1-0.dll, 24: api-ms-win-core-handle-l1-1-0.dll, 25: api-ms-win-core-heap-l1-1-0.dll, 26: api-ms-win-core-interlocked-l1-1-0.dll, 27: api-ms-win-core-io-l1-1-0.dll, 28: api-ms-win-core-libraryloader-l1-1-0.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4865214 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: api-ms-win-core-localization-l1-1-0.dll, 1: api-ms-win-core-localregistry-l1-1-0.dll, 2: api-ms-win-core-memory-l1-1-0.dll, 3: api-ms-win-core-misc-l1-1-0.dll, 4: api-ms-win-core-namedpipe-l1-1-0.dll, 5: api-ms-win-core-processenvironment-l1-1-0.dll, 6: api-ms-win-core-processthreads-l1-1-0.dll, 7: api-ms-win-core-profile-l1-1-0.dll, 8: api-ms-win-core-rtlsupport-l1-1-0.dll, 9: api-ms-win-core-string-l1-1-0.dll, 10: api-ms-win-core-synch-l1-1-0.dll, 11: api-ms-win-core-sysinfo-l1-1-0.dll, 12: api-ms-win-core-threadpool-l1-1-0.dll, 13: api-ms-win-core-util-l1-1-0.dll, 14: api-ms-win-core-xstate-l1-1-0.dll, 15: api-ms-win-security-base-l1-1-0.dll, 16: api-ms-win-security-lsalookup-l1-1-0.dll, 17: api-ms-win-security-sddl-l1-1-0.dll, 18: api-ms-win-service-core-l1-1-0.dll, 19: api-ms-win-service-management-l1-1-0.dll, 20: api-ms-win-service-management-l2-1-0.dll, 21: api-ms-win-service-winsvc-l1-1-0.dll, 22: apilogen.dll, 23: apircl.dll, 24: apisetschema.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4865716 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: append.exe, 1: apphelp.dll, 2: Apphlpdm.dll, 3: appidapi.dll, 4: appidcertstorecheck.exe, 5: appidpolicyconverter.exe, 6: AppIdPolicyEngineApi.dll, 7: appidsvc.dll, 8: appinfo.dll, 9: appmgmt, 10: appmgmts.dll, 11: appmgr.dll, 12: appwiz.cpl, 13: apss.dll, 14: ar-SA, 15: ARP.EXE, 16: ASAudioHD.ax, 17: asferror.dll, 18: aspnet_counters.dll, 19: aswBoot.exe, 20: asycfilt.dll, 21: at.exe, 22: AtBroker.exe, 23: ati2edxx.dll, 24: atiadlxx.dll, 25: atiapfxx.blb, 26: atiapfxx.exe, 27: atibtmon.exe, 28: aticalcl.dll, 29: aticaldd.dll, 30: aticalrt.dll, 31: aticfx32.dll, 32: ATIDEMGX.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4866158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: atidxx32.dll, 1: atieclxx.exe, 2: atiesrxx.exe, 3: atigktxx.dll, 4: atiglpxx.dll, 5: atiicdxx.dat, 6: atimpc32.dll, 7: atimuixx.dll, 8: ATIODCLI.exe, 9: ATIODE.exe, 10: atioglxx.dll, 11: atipblag.dat, 12: atipdlxx.dll, 13: atitmmxx.dll, 14: atiu9pag.dll, 15: atiumdag.dll, 16: atiumdmv.dll, 17: atiumdva.cap, 18: atiumdva.dll, 19: atiuxpag.dll, 20: ativvsva.dat, 21: ativvsvl.dat, 22: atl.dll, 23: atl100.dll, 24: atmfd.dll, 25: atmlib.dll, 26: attrib.exe, 27: audiodev.dll, 28: audiodg.exe, 29: AudioEng.dll, 30: AUDIOKSE.dll, 31: AudioSes.dll, 32: audiosrv.dll, 33: auditcse.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4866583 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: AuditNativeSnapIn.dll, 1: auditpol.exe, 2: AuditPolicyGPInterop.dll, 3: auditpolmsg.dll, 4: authfwcfg.dll, 5: AuthFWGP.dll, 6: AuthFWSnapin.dll, 7: AuthFWWizFwk.dll, 8: authui.dll, 9: authz.dll, 10: autochk.exe, 11: autoconv.exe, 12: autoexec.nt, 13: autofmt.exe, 14: autoplay.dll, 15: AuxiliaryDisplayApi.dll, 16: AuxiliaryDisplayClassInstaller.dll, 17: AuxiliaryDisplayCpl.dll, 18: AuxiliaryDisplayDriverLib.dll, 19: AuxiliaryDisplayServices.dll, 20: avicap.dll, 21: avicap32.dll, 22: avifil32.dll, 23: avifile.dll, 24: avisynth.dll, 25: avisynthMT.dll, 26: avisynthOld.dll, 27: avrt.dll, 28: AxInstSv.dll, 29: AxInstUI.exe, 30: azman.msc, 31: azroles.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4867006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: azroleui.dll, 1: AzSqlExt.dll, 2: baaupdate.exe, 3: basecsp.dll, 4: basesrv.dll, 5: batmeter.dll, 6: batt.dll, 7: bcdboot.exe, 8: bcdedit.exe, 9: bcdprov.dll, 10: bcdsrv.dll, 11: bcrypt.dll, 12: bcryptprimitives.dll, 13: bdaplgin.ax, 14: BdeHdCfg.exe, 15: BdeHdCfgLib.dll, 16: bderepair.dll, 17: bdesvc.dll, 18: bdeui.dll, 19: BdeUISrv.exe, 20: BdeUnlockWizard.exe, 21: BFE.DLL, 22: bg-BG, 23: bgsvcgen.exe, 24: bidispl.dll, 25: biocpl.dll, 26: BioCredProv.dll, 27: bios1.rom, 28: bios4.rom, 29: BitLockerWizard.exe, 30: BitLockerWizardElev.exe, 31: bitsadmin.exe, 32: bitsigd.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4867424 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: bitsperf.dll, 1: bitsprx2.dll, 2: bitsprx3.dll, 3: bitsprx4.dll, 4: bitsprx5.dll, 5: bitsprx6.dll, 6: blackbox.dll, 7: BlbEvents.dll, 8: blbres.dll, 9: blb_ps.dll, 10: Boot, 11: boot.sdi, 12: bootcfg.exe, 13: bootres.dll, 14: bootstr.dll, 15: BOOTVID.DLL, 16: bopomofo.uce, 17: borlndmm.dll, 18: brcoinst.dll, 19: brdgcfg.dll, 20: bridgeres.dll, 21: bridgeunattend.exe, 22: browcli.dll, 23: browser.dll, 24: browseui.dll, 25: bthci.dll, 26: BthMtpContextHandler.dll, 27: bthpanapi.dll, 28: BthpanContextHandler.dll, 29: bthprops.cpl, 30: bthserv.dll, 31: bthudtask.exe, 32: btpanui.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4867831 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: Bubbles.scr, 1: BWContextHandler.dll, 2: BWUnpairElevated.dll, 3: cabinet.dll, 4: cabview.dll, 5: cacls.exe, 6: calc.exe, 7: capiprovider.dll, 8: capisp.dll, 9: catroot, 10: catroot2, 11: catsrv.dll, 12: catsrvps.dll, 13: catsrvut.dll, 14: cc3250mt.dll, 15: cca.dll, 16: CCCInstall_201111151554408113.log, 17: cdd.dll, 18: cdosys.dll, 19: cedocida.dll, 20: cero.rs, 21: certcli.dll, 22: certCredProvider.dll, 23: certenc.dll, 24: CertEnroll.dll, 25: CertEnrollCtrl.exe, 26: CertEnrollUI.dll, 27: certmgr.dll, 28: certmgr.msc, 29: CertPolEng.dll, 30: certprop.dll, 31: certreq.exe, 32: certutil.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4868238 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: cewmdm.dll, 1: cfgbkend.dll, 2: cfgmgr32.dll, 3: chajei.ime, 4: change.exe, 5: charmap.exe, 6: chcp.com, 7: checkactivate.dll, 8: chglogon.exe, 9: chgport.exe, 10: chgusr.exe, 11: chkdsk.exe, 12: chkntfs.exe, 13: chkwudrv.dll, 14: choice.exe, 15: chsbrkr.dll, 16: chtbrkr.dll, 17: CHxReadingStringIME.dll, 18: ci.dll, 19: cic.dll, 20: cintlgnt.ime, 21: cipher.exe, 22: CIRCoInst.dll, 23: clb.dll, 24: clbcatq.dll, 25: cleanmgr.exe, 26: clfs.sys, 27: clfsw32.dll, 28: cliconfg.dll, 29: cliconfg.exe, 30: cliconfg.rll, 31: clip.exe, 32: clusapi.dll, 33: cmcfg32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4868691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: cmd.exe, 1: cmdial32.dll, 2: cmdkey.exe, 3: cmdl32.exe, 4: cmicryptinstall.dll, 5: cmifw.dll, 6: cmipnpinstall.dll, 7: cmlua.dll, 8: cmmon32.exe, 9: cmpbk32.dll, 10: cmstp.exe, 11: cmstplua.dll, 12: cmutil.dll, 13: cngaudit.dll, 14: cngprovider.dll, 15: cnvfat.dll, 16: CodeIntegrity, 17: cofire.exe, 18: cofiredm.dll, 19: coinst.dll, 20: colbact.dll, 21: collab.cpl, 22: COLORCNV.DLL, 23: colorcpl.exe, 24: colorui.dll, 25: com, 26: comcat.dll, 27: comctl32.dll, 28: COMCTL32.OCX, 29: comdlg32.dll, 30: COMDLG32.OCX, 31: comexp.msc, 32: COMM.drv, 33: COMMAND.COM</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4869130 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: COMMDLG.DLL, 1: comp.exe, 2: compact.exe, 3: compmgmt.msc, 4: CompMgmtLauncher.exe, 5: compobj.dll, 6: compstui.dll, 7: ComputerDefaults.exe, 8: comrepl.dll, 9: comres.dll, 10: comsnap.dll, 11: comsvcs.dll, 12: comuid.dll, 13: config, 14: config.nt, 15: conhost.exe, 16: connect.dll, 17: consent.exe, 18: console.dll, 19: control.exe, 20: convert.exe, 21: correngine.dll, 22: country.sys, 23: CPFilters.dll, 24: cpnotify.ax, 25: credssp.dll, 26: credui.dll, 27: credwiz.exe, 28: CRPPresentation.dll, 29: crtdll.dll, 30: crypt32.dll, 31: cryptbase.dll, 32: cryptdlg.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4869521 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: cryptdll.dll, 1: cryptext.dll, 2: cryptnet.dll, 3: cryptsp.dll, 4: cryptsvc.dll, 5: cryptui.dll, 6: cryptxml.dll, 7: cs-CZ, 8: cscapi.dll, 9: cscdll.dll, 10: CscMig.dll, 11: cscobj.dll, 12: cscript.exe, 13: cscsvc.dll, 14: cscui.dll, 15: csrr.rs, 16: csrsrv.dll, 17: csrss.exe, 18: csrstub.exe, 19: CSVer.dll, 20: ctfmon.exe, 21: ctl3d32.dll, 22: ctl3dv2.dll, 23: cttune.exe, 24: cttunesvr.exe, 25: CxPolaris.ax, 26: cxtvrate.dll, 27: C_037.NLS, 28: C_10000.NLS, 29: C_10001.NLS, 30: C_10002.NLS, 31: C_10003.NLS, 32: C_10004.NLS, 33: C_10005.NLS</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4869960 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: C_10006.NLS, 1: C_10007.NLS, 2: C_10008.NLS, 3: C_10010.NLS, 4: C_10017.NLS, 5: C_10021.NLS, 6: C_10029.NLS, 7: C_10079.NLS, 8: C_10081.NLS, 9: C_10082.NLS, 10: C_1026.NLS, 11: C_1047.NLS, 12: C_1140.NLS, 13: C_1141.NLS, 14: C_1142.NLS, 15: C_1143.NLS, 16: C_1144.NLS, 17: C_1145.NLS, 18: C_1146.NLS, 19: C_1147.NLS, 20: C_1148.NLS, 21: C_1149.NLS, 22: C_1250.NLS, 23: C_1251.NLS, 24: C_1252.NLS, 25: C_1253.NLS, 26: C_1254.NLS, 27: C_1255.NLS, 28: C_1256.NLS, 29: C_1257.NLS, 30: C_1258.NLS, 31: C_1361.NLS, 32: C_20000.NLS, 33: C_20001.NLS</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4870337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: C_20002.NLS, 1: C_20003.NLS, 2: C_20004.NLS, 3: C_20005.NLS, 4: C_20105.NLS, 5: C_20106.NLS, 6: C_20107.NLS, 7: C_20108.NLS, 8: C_20127.NLS, 9: C_20261.NLS, 10: C_20269.NLS, 11: C_20273.NLS, 12: C_20277.NLS, 13: C_20278.NLS, 14: C_20280.NLS, 15: C_20284.NLS, 16: C_20285.NLS, 17: C_20290.NLS, 18: C_20297.NLS, 19: C_20420.NLS, 20: C_20423.NLS, 21: C_20424.NLS, 22: C_20833.NLS, 23: C_20838.NLS, 24: C_20866.NLS, 25: C_20871.NLS, 26: C_20880.NLS, 27: C_20905.NLS, 28: C_20924.NLS, 29: C_20932.NLS, 30: C_20936.NLS, 31: C_20949.NLS, 32: C_21025.NLS, 33: C_21027.NLS</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4870736 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: C_21866.NLS, 1: C_28591.NLS, 2: C_28592.NLS, 3: C_28593.NLS, 4: C_28594.NLS, 5: C_28595.NLS, 6: C_28596.NLS, 7: C_28597.NLS, 8: C_28598.NLS, 9: C_28599.NLS, 10: c_28603.nls, 11: C_28605.NLS, 12: C_437.NLS, 13: C_500.NLS, 14: C_708.NLS, 15: C_720.NLS, 16: C_737.NLS, 17: C_775.NLS, 18: C_850.NLS, 19: C_852.NLS, 20: C_855.NLS, 21: C_857.NLS, 22: C_858.NLS, 23: C_860.NLS, 24: C_861.NLS, 25: C_862.NLS, 26: C_863.NLS, 27: C_864.NLS, 28: C_865.NLS, 29: C_866.NLS, 30: C_869.NLS, 31: C_870.NLS, 32: C_874.NLS, 33: C_875.NLS, 34: C_932.NLS</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4871121 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: C_936.NLS, 1: C_949.NLS, 2: C_950.NLS, 3: C_G18030.DLL, 4: C_IS2022.DLL, 5: C_ISCII.DLL, 6: d2d1.dll, 7: d3d10.dll, 8: d3d10core.dll, 9: d3d10level9.dll, 10: d3d10warp.dll, 11: d3d10_1.dll, 12: d3d10_1core.dll, 13: d3d11.dll, 14: d3d8.dll, 15: d3d8thk.dll, 16: d3d9.dll, 17: D3DCompiler_33.dll, 18: D3DCompiler_34.dll, 19: D3DCompiler_35.dll, 20: D3DCompiler_36.dll, 21: D3DCompiler_37.dll, 22: D3DCompiler_38.dll, 23: D3DCompiler_39.dll, 24: D3DCompiler_40.dll, 25: D3DCompiler_41.dll, 26: D3DCompiler_42.dll, 27: D3DCompiler_43.dll, 28: d3dcsx_42.dll, 29: d3dcsx_43.dll, 30: d3dim.dll, 31: d3dim700.dll, 32: d3dramp.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4871714 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: d3dx10.dll, 1: d3dx10_33.dll, 2: d3dx10_34.dll, 3: d3dx10_35.dll, 4: d3dx10_36.dll, 5: d3dx10_37.dll, 6: d3dx10_38.dll, 7: d3dx10_39.dll, 8: d3dx10_40.dll, 9: d3dx10_41.dll, 10: d3dx10_42.dll, 11: d3dx10_43.dll, 12: d3dx11_42.dll, 13: d3dx11_43.dll, 14: d3dx9_24.dll, 15: d3dx9_25.dll, 16: d3dx9_26.dll, 17: d3dx9_27.dll, 18: d3dx9_28.dll, 19: d3dx9_29.dll, 20: d3dx9_30.dll, 21: d3dx9_31.dll, 22: d3dx9_32.dll, 23: d3dx9_33.dll, 24: d3dx9_34.dll, 25: d3dx9_35.dll, 26: d3dx9_36.dll, 27: D3DX9_37.dll, 28: D3DX9_38.dll, 29: D3DX9_39.dll, 30: D3DX9_40.dll, 31: D3DX9_41.dll, 32: D3DX9_42.dll, 33: D3DX9_43.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4872178 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: d3dxof.dll, 1: da-DK, 2: dataclen.dll, 3: davclnt.dll, 4: davhlpr.dll, 5: dbgeng.dll, 6: dbghelp.dll, 7: dbnetlib.dll, 8: dbnmpntw.dll, 9: dccw.exe, 10: dciman32.dll, 11: dcomcnfg.exe, 12: DDACLSys.dll, 13: DDEML.DLL, 14: ddodiag.exe, 15: DDOIProxy.dll, 16: DDORes.dll, 17: ddraw.dll, 18: ddrawex.dll, 19: de-DE, 20: debug.exe, 21: defaultlocationcpl.dll, 22: Defrag.exe, 23: defragproxy.dll, 24: defragsvc.dll, 25: desk.cpl, 26: deskadp.dll, 27: deskmon.dll, 28: deskperf.dll, 29: desktop.ini, 30: devenum.dll, 31: DeviceCenter.dll, 32: DeviceDisplayObjectProvider.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4872590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: DeviceDisplayStatusManager.dll, 1: DeviceEject.exe, 2: DeviceMetadataParsers.dll, 3: DevicePairing.dll, 4: DevicePairingFolder.dll, 5: DevicePairingHandler.dll, 6: DevicePairingProxy.dll, 7: DevicePairingWizard.exe, 8: DeviceProperties.exe, 9: DeviceUxRes.dll, 10: devil.dll, 11: devmgmt.msc, 12: devmgr.dll, 13: devobj.dll, 14: devrtl.dll, 15: dfdts.dll, 16: DFDWiz.exe, 17: dfrgui.exe, 18: dfscli.dll, 19: dfshim.dll, 20: DfsShlEx.dll, 21: dhcpcmonitor.dll, 22: dhcpcore.dll, 23: dhcpcore6.dll, 24: dhcpcsvc.dll, 25: dhcpcsvc6.dll, 26: DHCPQEC.DLL, 27: dhcpsapi.dll, 28: DiagCpl.dll, 29: DiagFunc.dll, 30: DiagFunc.ini, 31: diagperf.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4873040 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: dialer.exe, 1: diantz.exe, 2: difxapi.dll, 3: dimsjob.dll, 4: dimsroam.dll, 5: dinotify.exe, 6: dinput.dll, 7: dinput8.dll, 8: directx, 9: diskcomp.com, 10: diskcopy.com, 11: diskcopy.dll, 12: diskmgmt.msc, 13: diskpart.exe, 14: diskperf.exe, 15: diskraid.exe, 16: Dism, 17: Dism.exe, 18: dispci.dll, 19: dispdiag.exe, 20: dispex.dll, 21: Display.dll, 22: DisplaySwitch.exe, 23: djoin.exe, 24: DLLAV32.dll, 25: DLLCPY32.dll, 26: DLLDEV32.dll, 27: DLLDEV32i.dll, 28: DLLDRV32.dll, 29: dllhost.exe, 30: dllhst3g.exe, 31: DLLIO32.dll, 32: DLLPNT32.dll, 33: DLLPRF32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4873517 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: DLLRES32.dll, 1: dmband.dll, 2: dmcompos.dll, 3: dmdlgs.dll, 4: dmdskmgr.dll, 5: dmdskres.dll, 6: dmdskres2.dll, 7: dmime.dll, 8: dmintf.dll, 9: dmloader.dll, 10: dmocx.dll, 11: dmrc.dll, 12: dmscript.dll, 13: dmstyle.dll, 14: dmsynth.dll, 15: dmusic.dll, 16: dmutil.dll, 17: dmvdsitf.dll, 18: dmview.ocx, 19: dmvscres.dll, 20: dnsapi.dll, 21: dnscacheugc.exe, 22: dnscmmc.dll, 23: dnsext.dll, 24: dnshc.dll, 25: dnsrslvr.dll, 26: docprop.dll, 27: DocumentPerformanceEvents.dll, 28: doskey.exe, 29: dosx.exe, 30: dot3api.dll, 31: dot3cfg.dll, 32: dot3dlg.dll, 33: dot3gpclnt.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4873943 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: dot3gpui.dll, 1: dot3hc.dll, 2: dot3msm.dll, 3: dot3svc.dll, 4: dot3ui.dll, 5: dpapimig.exe, 6: dpapiprovider.dll, 7: DpiScaling.exe, 8: dplaysvr.exe, 9: dplayx.dll, 10: dpmodemx.dll, 11: dpnaddr.dll, 12: dpnathlp.dll, 13: dpnet.dll, 14: dpnhpast.dll, 15: dpnhupnp.dll, 16: dpnlobby.dll, 17: dpnsvr.exe, 18: dps.dll, 19: dpwsockx.dll, 20: dpx.dll, 21: driverquery.exe, 22: drivers, 23: DriverStore, 24: drmmgrtn.dll, 25: drmv2clt.dll, 26: drprov.dll, 27: drt.dll, 28: drtprov.dll, 29: drttransport.dll, 30: drvinst.exe, 31: drvstore.dll, 32: DRWATSON.EXE, 33: ds16gt.dLL</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4874403 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: ds32gt.dll, 1: dsauth.dll, 2: dsdmo.dll, 3: DShowRdpFilter.dll, 4: dskquota.dll, 5: dskquoui.dll, 6: dsound.dll, 7: dsprop.dll, 8: dsquery.dll, 9: dsrole.dll, 10: dssec.dat, 11: dssec.dll, 12: dssenh.dll, 13: dsuiext.dll, 14: dswave.dll, 15: dtsdecoderdll.dll, 16: dtsh.dll, 17: dui70.dll, 18: duser.dll, 19: dvdplay.exe, 20: dvdupgrd.exe, 21: DVobSub.ax, 22: dwm.exe, 23: dwmapi.dll, 24: dwmcore.dll, 25: dwmredir.dll, 26: DWrite.dll, 27: DWWIN.EXE, 28: dxdiag.exe, 29: dxdiagn.dll, 30: dxgi.dll, 31: dxmasf.dll, 32: DXP.dll, 33: dxpps.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4874853 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: Dxpserver.exe, 1: DXPTaskRingtone.dll, 2: DxpTaskSync.dll, 3: dxtmsft.dll, 4: dxtrans.dll, 5: dxva2.dll, 6: Eap3Host.exe, 7: eapp3hst.dll, 8: eappcfg.dll, 9: eappgnui.dll, 10: eapphost.dll, 11: eappprxy.dll, 12: EAPQEC.DLL, 13: eapsvc.dll, 14: edit.com, 15: EDIT.HLP, 16: edlin.exe, 17: efsadu.dll, 18: efscore.dll, 19: efslsaext.dll, 20: efssvc.dll, 21: efsui.exe, 22: efsutil.dll, 23: ega.cpi, 24: EhStorAPI.dll, 25: EhStorAuthn.exe, 26: EhStorPwdMgr.dll, 27: EhStorShell.dll, 28: el-GR, 29: els.dll, 30: ELSCore.dll, 31: elslad.dll, 32: elsTrans.dll, 33: en</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4875279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: en-US, 1: encapi.dll, 2: EncDec.dll, 3: EncDump.dll, 4: energy.dll, 5: eqossnap.dll, 6: es-ES, 7: es.dll, 8: esent.dll, 9: esentprf.dll, 10: esentutl.exe, 11: esrb.rs, 12: et-EE, 13: eudcedit.exe, 14: eventcls.dll, 15: eventcreate.exe, 16: EventViewer_EventDetails.xsl, 17: eventvwr.exe, 18: eventvwr.msc, 19: evr.dll, 20: exe2bin.exe, 21: expand.exe, 22: ExplorerFrame.dll, 23: expsrv.dll, 24: extrac32.exe, 25: f3ahvoas.dll, 26: fastopen.exe, 27: Faultrep.dll, 28: fc.exe, 29: fdBth.dll, 30: fdBthProxy.dll, 31: fde.dll, 32: fdeploy.dll, 33: fdPHost.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4875683 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: fdPnp.dll, 1: fdprint.dll, 2: fdProxy.dll, 3: FDResPub.dll, 4: fdSSDP.dll, 5: fdWCN.dll, 6: fdWNet.dll, 7: fdWSD.dll, 8: feclient.dll, 9: ff_acm.acm, 10: ff_vfw.dll, 11: fi-FI, 12: filemgmt.dll, 13: find.exe, 14: findnetprinters.dll, 15: findstr.exe, 16: finger.exe, 17: Firewall.cpl, 18: FirewallAPI.dll, 19: FirewallControlPanel.dll, 20: fixmapi.exe, 21: FlashPlayerApp.exe, 22: FlashPlayerCPLApp.cpl, 23: fltLib.dll, 24: fltMC.exe, 25: FLVSplitter.ax, 26: fmifs.dll, 27: fms.dll, 28: FNTCACHE.DAT, 29: FntCache.dll, 30: fontext.dll, 31: fontsub.dll, 32: fontview.exe, 33: forfiles.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4876163 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: format.com, 1: fphc.dll, 2: fr-FR, 3: framebuf.dll, 4: framedyn.dll, 5: framedynos.dll, 6: fsmgmt.msc, 7: fsutil.exe, 8: fthsvc.dll, 9: ftp.exe, 10: fundisc.dll, 11: fveapi.dll, 12: fveapibase.dll, 13: fvecerts.dll, 14: fvecpl.dll, 15: fvenotify.exe, 16: fveprompt.exe, 17: fveRecover.dll, 18: fveui.dll, 19: fvewiz.dll, 20: fwcfg.dll, 21: FWPUCLNT.DLL, 22: FwRemoteSvr.dll, 23: FXSAPI.dll, 24: FXSCOM.dll, 25: FXSCOMEX.dll, 26: FXSCOMPOSE.dll, 27: FXSCOMPOSERES.dll, 28: FXSCOVER.exe, 29: FXSEVENT.dll, 30: FXSEXT32.dll, 31: FXSMON.dll, 32: FXSRESM.dll, 33: FXSROUTE.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4876570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: FXSST.dll, 1: FXSSVC.exe, 2: FXST30.dll, 3: FXSTIFF.dll, 4: FxsTmp, 5: FXSUNATD.exe, 6: FXSUTILITY.dll, 7: FXSXP32.dll, 8: g711codc.ax, 9: gacinstall.dll, 10: gameux.dll, 11: GameUXLegacyGDFs.dll, 12: gatherNetworkInfo.vbs, 13: GAUGE32.OCX, 14: gb2312.uce, 15: gcdef.dll, 16: gdi+.tlb, 17: GDI.EXE, 18: gdi32.dll, 19: gdiplus.dll, 20: GenSvcInst.exe, 21: getmac.exe, 22: GettingStarted.exe, 23: getuname.dll, 24: glmf32.dll, 25: glu32.dll, 26: gpapi.dll, 27: gpedit.dll, 28: gpedit.msc, 29: gpprefcl.dll, 30: gpprnext.dll, 31: gpresult.exe, 32: gpscript.dll, 33: gpscript.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4876982 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: gpsvc.dll, 1: gptext.dll, 2: gpupdate.exe, 3: graftabl.com, 4: GRAPHICS.COM, 5: graphics.pro, 6: grb.rs, 7: Groupinghc.dll, 8: GroupPolicy, 9: GroupPolicyUsers, 10: grpconv.exe, 11: GVTunner.ref, 12: hal.dll, 13: halacpi.dll, 14: halmacpi.dll, 15: hbaapi.dll, 16: hcproviders.dll, 17: hcw85enc.ax, 18: hcw85prop.ax, 19: hcwcp.ax, 20: hcwecppp.ax, 21: hcwi2c32.dll, 22: hcwmsCP885.ax, 23: hcwpnp32.dll, 24: hcwtvwnd.dll, 25: hcwutl32.dll, 26: hcwxds.dll, 27: hdwwiz.cpl, 28: hdwwiz.exe, 29: he-IL, 30: help.exe, 31: HelpPaneProxy.dll, 32: hgcpl.dll, 33: hgprint.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4877416 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: hhctrl.ocx, 1: hhsetup.dll, 2: hid.dll, 3: hidphone.tsp, 4: hidserv.dll, 5: HIMEM.SYS, 6: HiTime32.OCX, 7: hlink.dll, 8: hnetcfg.dll, 9: hnetmon.dll, 10: HOSTNAME.EXE, 11: hotplug.dll, 12: HotStartUserAgent.dll, 13: hr-HR, 14: html.iec, 15: httpapi.dll, 16: htui.dll, 17: hu-HU, 18: HUFFYUV.DLL, 19: hwrcomp.exe, 20: hwrreg.exe, 21: iac25_32.ax, 22: ias, 23: ias.dll, 24: iasacct.dll, 25: iasads.dll, 26: iasdatastore.dll, 27: iashlpr.dll, 28: IasMigPlugin.dll, 29: iasnap.dll, 30: iaspolcy.dll, 31: iasrad.dll, 32: iasrecst.dll, 33: iassam.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4877885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: iassdo.dll, 1: iassvcs.dll, 2: icaapi.dll, 3: icacls.exe, 4: icardagt.exe, 5: icardie.dll, 6: icardres.dll, 7: IcCoinstall.dll, 8: iccvid.dll, 9: icfupgd.dll, 10: icm32.dll, 11: icmp.dll, 12: icmui.dll, 13: IconCodecService.dll, 14: icrav03.rat, 15: icsigd.dll, 16: icsunattend.exe, 17: icsxml, 18: ideograf.uce, 19: IdListen.dll, 20: idndl.dll, 21: IDStore.dll, 22: ie4uinit.exe, 23: IEAdvpack.dll, 24: ieakeng.dll, 25: ieaksie.dll, 26: ieakui.dll, 27: ieapfltr.dat, 28: ieapfltr.dll, 29: iedkcs32.dll, 30: ieframe.dll, 31: iepeers.dll, 32: iernonce.dll, 33: iertutil.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4878316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: iesetup.dll, 1: iesysprep.dll, 2: ieui.dll, 3: ieuinit.inf, 4: ieUnatt.exe, 5: iexpress.exe, 6: ifmon.dll, 7: ifsutil.dll, 8: ifsutilx.dll, 9: igdDiag.dll, 10: IKEEXT.DLL, 11: imaadp32.acm, 12: imagehlp.dll, 13: imageres.dll, 14: imagesp1.dll, 15: imapi.dll, 16: imapi2.dll, 17: imapi2fs.dll, 18: IME, 19: imgutil.dll, 20: IMJP10.IME, 21: IMJP10K.DLL, 22: imkr80.ime, 23: imm32.dll, 24: inetcomm.dll, 25: inetcpl.cpl, 26: inetmib1.dll, 27: inetpp.dll, 28: inetppui.dll, 29: INETRES.dll, 30: inetsrv, 31: InfDefaultInstall.exe, 32: infocardapi.dll, 33: infocardcpl.cpl</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4878712 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: InkEd.dll, 1: input.dll, 2: inseng.dll, 3: InstallPackage_ETW.Log, 4: intl.cpl, 5: iologmsg.dll, 6: IPBusEnum.dll, 7: IPBusEnumProxy.dll, 8: ipconfig.exe, 9: IPHLPAPI.DLL, 10: iphlpsvc.dll, 11: ipnathlp.dll, 12: iprop.dll, 13: iprtprio.dll, 14: iprtrmgr.dll, 15: ipsecsnp.dll, 16: IPSECSVC.DLL, 17: ipsmsnap.dll, 18: ir32_32.dll, 19: ir41_32.ax, 20: ir41_qc.dll, 21: ir41_qcx.dll, 22: ir50_32.dll, 23: ir50_qc.dll, 24: ir50_qcx.dll, 25: irclass.dll, 26: irftp.exe, 27: irmon.dll, 28: irprops.cpl, 29: iscsicli.exe, 30: iscsicpl.dll, 31: iscsicpl.exe, 32: iscsidsc.dll, 33: iscsied.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4879203 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: iscsiexe.dll, 1: iscsilog.dll, 2: iscsium.dll, 3: iscsiwmi.dll, 4: isoburn.exe, 5: ISSRemoveSP.exe, 6: ISUSPM.cpl, 7: it-IT, 8: itircl.dll, 9: itss.dll, 10: iTVData.dll, 11: ivfsrc.ax, 12: iyuv_32.dll, 13: ja-JP, 14: java.exe, 15: javaw.exe, 16: javaws.exe, 17: jnwmon.dll, 18: joy.cpl, 19: JoyStk32.OCX, 20: jscript.dll, 21: jscript9.dll, 22: jsproxy.dll, 23: kanji_1.uce, 24: kanji_2.uce, 25: KB16.COM, 26: kbd101.dll, 27: kbd101a.dll, 28: kbd101b.dll, 29: kbd101c.dll, 30: kbd103.dll, 31: kbd106.dll, 32: kbd106n.dll, 33: KBDA1.DLL</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4879650 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: KBDA2.DLL, 1: KBDA3.DLL, 2: KBDAL.DLL, 3: KBDARME.DLL, 4: KBDARMW.DLL, 5: kbdax2.dll, 6: KBDAZE.DLL, 7: KBDAZEL.DLL, 8: KBDBASH.DLL, 9: KBDBE.DLL, 10: KBDBENE.DLL, 11: KBDBGPH.DLL, 12: KBDBGPH1.DLL, 13: KBDBHC.DLL, 14: KBDBLR.DLL, 15: KBDBR.DLL, 16: KBDBU.DLL, 17: KBDBULG.DLL, 18: KBDCA.DLL, 19: KBDCAN.DLL, 20: KBDCR.DLL, 21: KBDCZ.DLL, 22: KBDCZ1.DLL, 23: KBDCZ2.DLL, 24: KBDDA.DLL, 25: KBDDIV1.DLL, 26: KBDDIV2.DLL, 27: KBDDV.DLL, 28: KBDES.DLL, 29: KBDEST.DLL, 30: KBDFA.DLL, 31: KBDFC.DLL, 32: KBDFI.DLL, 33: KBDFI1.DLL, 34: KBDFO.DLL</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4880043 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: KBDFR.DLL, 1: KBDGAE.DLL, 2: KBDGEO.DLL, 3: kbdgeoer.dll, 4: kbdgeoqw.dll, 5: KBDGKL.DLL, 6: KBDGR.DLL, 7: KBDGR1.DLL, 8: KBDGRLND.DLL, 9: KBDHAU.DLL, 10: KBDHE.DLL, 11: KBDHE220.DLL, 12: KBDHE319.DLL, 13: KBDHEB.DLL, 14: KBDHELA2.DLL, 15: KBDHELA3.DLL, 16: KBDHEPT.DLL, 17: KBDHU.DLL, 18: KBDHU1.DLL, 19: kbdibm02.dll, 20: KBDIBO.DLL, 21: KBDIC.DLL, 22: KBDINASA.DLL, 23: KBDINBE1.DLL, 24: KBDINBE2.DLL, 25: KBDINBEN.DLL, 26: KBDINDEV.DLL, 27: KBDINGUJ.DLL, 28: KBDINHIN.DLL, 29: KBDINKAN.DLL, 30: KBDINMAL.DLL, 31: KBDINMAR.DLL, 32: KBDINORI.DLL, 33: KBDINPUN.DLL</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4880426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: KBDINTAM.DLL, 1: KBDINTEL.DLL, 2: KBDINUK2.DLL, 3: KBDIR.DLL, 4: KBDIT.DLL, 5: KBDIT142.DLL, 6: KBDIULAT.DLL, 7: KBDJPN.DLL, 8: KBDKAZ.DLL, 9: KBDKHMR.DLL, 10: KBDKOR.DLL, 11: KBDKYR.DLL, 12: KBDLA.DLL, 13: KBDLAO.DLL, 14: kbdlk41a.dll, 15: KBDLT.DLL, 16: KBDLT1.DLL, 17: KBDLT2.DLL, 18: KBDLV.DLL, 19: KBDLV1.DLL, 20: KBDMAC.DLL, 21: KBDMACST.DLL, 22: KBDMAORI.DLL, 23: KBDMLT47.DLL, 24: KBDMLT48.DLL, 25: KBDMON.DLL, 26: KBDMONMO.DLL, 27: KBDNE.DLL, 28: kbdnec.dll, 29: kbdnec95.dll, 30: kbdnecat.dll, 31: kbdnecnt.dll, 32: KBDNEPR.DLL, 33: KBDNO.DLL</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4880811 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: KBDNO1.DLL, 1: KBDNSO.DLL, 2: KBDPASH.DLL, 3: KBDPL.DLL, 4: KBDPL1.DLL, 5: KBDPO.DLL, 6: KBDRO.DLL, 7: KBDROPR.DLL, 8: KBDROST.DLL, 9: KBDRU.DLL, 10: KBDRU1.DLL, 11: KBDSF.DLL, 12: KBDSG.DLL, 13: KBDSL.DLL, 14: KBDSL1.DLL, 15: KBDSMSFI.DLL, 16: KBDSMSNO.DLL, 17: KBDSN1.DLL, 18: KBDSOREX.DLL, 19: KBDSORS1.DLL, 20: KBDSORST.DLL, 21: KBDSP.DLL, 22: KBDSW.DLL, 23: KBDSW09.DLL, 24: KBDSYR1.DLL, 25: KBDSYR2.DLL, 26: KBDTAJIK.DLL, 27: KBDTAT.DLL, 28: KBDTH0.DLL, 29: KBDTH1.DLL, 30: KBDTH2.DLL, 31: KBDTH3.DLL, 32: KBDTIPRC.DLL, 33: KBDTUF.DLL</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4881194 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: KBDTUQ.DLL, 1: KBDTURME.DLL, 2: KBDUGHR.DLL, 3: KBDUGHR1.DLL, 4: KBDUK.DLL, 5: KBDUKX.DLL, 6: KBDUR.DLL, 7: KBDUR1.DLL, 8: KBDURDU.DLL, 9: KBDUS.DLL, 10: KBDUSA.DLL, 11: KBDUSL.DLL, 12: KBDUSR.DLL, 13: KBDUSX.DLL, 14: KBDUZB.DLL, 15: KBDVNTC.DLL, 16: KBDWOL.DLL, 17: KBDYAK.DLL, 18: KBDYBA.DLL, 19: KBDYCC.DLL, 20: KBDYCL.DLL, 21: kd1394.dll, 22: kdcom.dll, 23: kdusb.dll, 24: kerberos.dll, 25: kernel32.dll, 26: KernelBase.dll, 27: kernelceip.dll, 28: KEY01.SYS, 29: keyboard.drv, 30: KEYBOARD.SYS, 31: keyiso.dll, 32: keymgr.dll, 33: klist.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4881590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: kmddsp.tsp, 1: KMSVC.DLL, 2: ko-KR, 3: korean.uce, 4: korwbrkr.dll, 5: korwbrkr.lex, 6: krnl386.exe, 7: ksetup.exe, 8: ksproxy.ax, 9: kstvtune.ax, 10: ksuser.dll, 11: Kswdmcap.ax, 12: ksxbar.ax, 13: ktmutil.exe, 14: ktmw32.dll, 15: l2gpstore.dll, 16: l2nacp.dll, 17: L2SecHC.dll, 18: l3codeca.acm, 19: l3codecp.acm, 20: label.exe, 21: lagarith.dll, 22: LameACM.acm, 23: lame_acm.xml, 24: LangCleanupSysprepAction.dll, 25: lanman.drv, 26: LAPRXY.DLL, 27: lcphrase.tbl, 28: lcptr.tbl, 29: lfbmp13n.dll, 30: LFCMP13n.DLL, 31: lfeps13n.dll, 32: lffax13n.dll, 33: lfgif13n.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4882086 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: lfpcd13n.dll, 1: lfpcx13n.dll, 2: Lfpng13n.dll, 3: lfpsd13n.dll, 4: lftga13n.dll, 5: lftif13n.dll, 6: lfwmf13n.dll, 7: libeay32.dll, 8: libfftw3-3.dll, 9: libFLAC.dll, 10: libssl32.dll, 11: license.rtf, 12: licmgr10.dll, 13: linkinfo.dll, 14: ListSvc.dll, 15: lltdapi.dll, 16: lltdres.dll, 17: lltdsvc.dll, 18: lmhsvc.dll, 19: LOADFIX.COM, 20: loadperf.dll, 21: locale.nls, 22: LocalGroupAdminAdd.log, 23: localsec.dll, 24: localspl.dll, 25: localui.dll, 26: Local_LLU.log, 27: LocationApi.dll, 28: LocationNotifications.exe, 29: locationnotificationsview.xml, 30: Locator.exe, 31: lodctr.exe, 32: logagent.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4882514 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: LogFiles, 1: loghours.dll, 2: logman.exe, 3: logoff.exe, 4: logoncli.dll, 5: LogonUI.exe, 6: lpk.dll, 7: lpksetup.exe, 8: lpksetupproxyserv.dll, 9: lpremove.exe, 10: lsasrv.dll, 11: lsass.exe, 12: LSCSHostPolicy.dll, 13: lsm.exe, 14: lsmproxy.dll, 15: lt-LT, 16: Ltclr13n.dll, 17: LTDIS13n.dll, 18: ltefx13n.DLL, 19: ltfil13n.DLL, 20: ltimg13n.dll, 21: ltkrn13n.dll, 22: Ltwvc13n.dll, 23: luainstall.dll, 24: lusrmgr.msc, 25: lv-LV, 26: lz32.dll, 27: lzexpand.dll, 28: l_intl.nls, 29: Macromed, 30: madFlac.ax, 31: MagCore.dll, 32: Magnification.dll, 33: Magnify.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4882954 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: MagPCMac.dll, 1: MagUIEngine.dll, 2: MagUIInter.dll, 3: main.cpl, 4: makecab.exe, 5: manage-bde.exe, 6: manage-bde.wsf, 7: manifeststore, 8: mapi32.dll, 9: mapistub.dll, 10: mapisvc.inf, 11: mblctr.exe, 12: mcbuilder.exe, 13: MCEWMDRMNDBootstrap.dll, 14: MCI32.OCX, 15: mciavi.drv, 16: mciavi32.dll, 17: mcicda.dll, 18: mciqtz32.dll, 19: mciseq.dll, 20: mciseq.drv, 21: mciwave.dll, 22: mciwave.drv, 23: mcmde.dll, 24: mcsrchPH.dll, 25: mctadmin.exe, 26: mctres.dll, 27: mcupdate_AuthenticAMD.dll, 28: mcupdate_GenuineIntel.dll, 29: Mcx2Svc.dll, 30: McxDriv.dll, 31: mdminst.dll, 32: MdRes.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4883366 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: MdSched.exe, 1: MediaMetadataHandler.dll, 2: mem.exe, 3: memdiag.dll, 4: mercalli-protocol.txt, 5: mf.dll, 6: mf3216.dll, 7: mfAACEnc.dll, 8: mfc100.dll, 9: mfc100chs.dll, 10: mfc100cht.dll, 11: mfc100deu.dll, 12: mfc100enu.dll, 13: mfc100esn.dll, 14: mfc100fra.dll, 15: mfc100ita.dll, 16: mfc100jpn.dll, 17: mfc100kor.dll, 18: mfc100rus.dll, 19: mfc100u.dll, 20: mfc40.dll, 21: mfc40u.dll, 22: mfc42.dll, 23: mfc42u.dll, 24: MFC4310e.rra, 25: mfc70.dll, 26: mfcm100.dll, 27: mfcm100u.dll, 28: mfcsubs.dll, 29: mfds.dll, 30: mfdvdec.dll, 31: mferror.dll, 32: mfh264enc.dll, 33: mfmjpegdec.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4883891 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: mfplat.dll, 1: MFPlay.dll, 2: mfpmp.exe, 3: mfps.dll, 4: mfreadwrite.dll, 5: mfvdsp.dll, 6: MFWMAAEC.DLL, 7: mgmtapi.dll, 8: Mhddraw.ocx, 9: Microsoft, 10: microsoft-windows-hal-events.dll, 11: microsoft-windows-kernel-power-events.dll, 12: microsoft-windows-kernel-processor-power-events.dll, 13: midimap.dll, 14: MigAutoPlay.exe, 15: migisol.dll, 16: migration, 17: miguiresource.dll, 18: migwiz, 19: migwiz.lnk, 20: mimefilt.dll, 21: mkl_wavearts.dll, 22: mlang.dat, 23: mlang.dll, 24: mmc.exe, 25: mmcbase.dll, 26: mmci.dll, 27: mmcico.dll, 28: mmcndmgr.dll, 29: mmcshext.dll, 30: mmcss.dll, 31: MMDevAPI.dll, 32: mmres.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4884336 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: mmsys.cpl, 1: MMSYSTEM.DLL, 2: mmtask.tsk, 3: mobsync.exe, 4: mode.com, 5: modemui.dll, 6: montr_ci.dll, 7: more.com, 8: moricons.dll, 9: mountvol.exe, 10: mouse.drv, 11: MP3DMOD.DLL, 12: MP43DECD.DLL, 13: MP4SDECD.DLL, 14: Mpeg2Data.ax, 15: mpg2splt.ax, 16: MPG4DECD.DLL, 17: mpnotify.exe, 18: mpr.dll, 19: mprapi.dll, 20: mprddm.dll, 21: mprdim.dll, 22: mprmsg.dll, 23: MpSigStub.exe, 24: MPSSVC.dll, 25: MRINFO.EXE, 26: MRT.exe, 27: msaatext.dll, 28: MSAC3ENC.DLL, 29: msacm.dll, 30: msacm32.dll, 31: msacm32.drv, 32: msadp32.acm, 33: msafd.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4884732 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: msasn1.dll, 1: msaudite.dll, 2: mscandui.dll, 3: mscat32.dll, 4: mscdexnt.exe, 5: msclmd.dll, 6: mscms.dll, 7: MSCOMCTL.OCX, 8: msconfig.exe, 9: mscoree.dll, 10: mscorier.dll, 11: mscories.dll, 12: mscpx32r.dLL, 13: mscpxl32.dLL, 14: msctf.dll, 15: msctfime.ime, 16: MsCtfMonitor.dll, 17: msctfp.dll, 18: msctfui.dll, 19: msdadiag.dll, 20: msdart.dll, 21: msdatsrc.tlb, 22: msdelta.dll, 23: msdmo.dll, 24: msdri.dll, 25: msdrm.dll, 26: msdt.exe, 27: Msdtc, 28: msdtc.exe, 29: msdtckrm.dll, 30: msdtclog.dll, 31: msdtcprx.dll, 32: msdtctm.dll, 33: msdtcuiu.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4885209 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: msdtcVSp1res.dll, 1: MSDvbNP.ax, 2: msdxm.ocx, 3: msdxm.tlb, 4: msexch40.dll, 5: msexcl40.dll, 6: msfeeds.dll, 7: msfeedsbs.dll, 8: msfeedssync.exe, 9: MSFLXGRD.OCX, 10: msftedit.dll, 11: msg.exe, 12: msg711.acm, 13: msgsm32.acm, 14: mshta.exe, 15: mshtml.dll, 16: mshtml.tlb, 17: mshtmled.dll, 18: mshtmler.dll, 19: msi.dll, 20: MsiCofire.dll, 21: msidcrl30.dll, 22: msident.dll, 23: msidle.dll, 24: msidntld.dll, 25: msieftp.dll, 26: msiexec.exe, 27: msihnd.dll, 28: msiltcfg.dll, 29: msimg32.dll, 30: msimsg.dll, 31: msimtf.dll, 32: msinfo32.exe, 33: msisip.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4885635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: msjet40.dll, 1: msjetoledb40.dll, 2: msjint40.dll, 3: msjter40.dll, 4: msjtes40.dll, 5: msls2.dll, 6: msls31.dll, 7: msltus40.dll, 8: MSLUP60.dll, 9: MSLURT.dll, 10: MSMASK32.OCX, 11: msmmsp.dll, 12: msmpeg2adec.dll, 13: MSMPEG2ENC.DLL, 14: msmpeg2vdec.dll, 15: msnetobj.dll, 16: MSNP.ax, 17: msobjs.dll, 18: msoeacct.dll, 19: msoert2.dll, 20: msorc32r.dll, 21: msorcl32.dll, 22: mspaint.exe, 23: mspatcha.dll, 24: mspbda.dll, 25: MsPbdaCoInst.dll, 26: mspbde40.dll, 27: msports.dll, 28: msprivs.dll, 29: msra.exe, 30: msrahc.dll, 31: MsraLegacy.tlb, 32: msrating.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4886096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: msrd2x40.dll, 1: msrd3x40.dll, 2: msrdc.dll, 3: MsRdpWebAccess.dll, 4: msrepl40.dll, 5: msrle32.dll, 6: msscntrs.dll, 7: msscp.dll, 8: msscript.ocx, 9: mssha.dll, 10: msshavmsg.dll, 11: msshooks.dll, 12: mssign32.dll, 13: mssip32.dll, 14: mssitlb.dll, 15: mssph.dll, 16: mssphtb.dll, 17: mssprxy.dll, 18: mssrch.dll, 19: mssvp.dll, 20: msswch.dll, 21: mstask.dll, 22: mstext40.dll, 23: mstsc.exe, 24: mstscax.dll, 25: msutb.dll, 26: msv1_0.dll, 27: MSVBVM50.DLL, 28: msvbvm60.dll, 29: msvc333f.rra, 30: msvcirt.dll, 31: msvcp100.dll, 32: msvcp110.dll, 33: Msvcp50.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4886546 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: msvcp60.dll, 1: MSVCP60D.DLL, 2: msvcp70.dll, 3: msvcp71.dll, 4: msvcr100.dll, 5: msvcr100_clr0400.dll, 6: msvcr110.dll, 7: msvcr70.dll, 8: msvcr71.dll, 9: msvcrt.dll, 10: msvcrt20.dll, 11: msvcrt40.dll, 12: msvfw32.dll, 13: msvidc32.dll, 14: MSVidCtl.dll, 15: msvideo.dll, 16: mswdat10.dll, 17: mswmdm.dll, 18: mswsock.dll, 19: mswstr10.dll, 20: msxbde40.dll, 21: msxml3.dll, 22: msxml3r.dll, 23: msxml4.dll, 24: msxml4r.dll, 25: msxml6.dll, 26: msxml6r.dll, 27: msyuv.dll, 28: mtstocom.exe, 29: mtxclu.dll, 30: mtxdm.dll, 31: mtxex.dll, 32: mtxlegih.dll, 33: mtxoci.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4886955 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: MUI, 1: muifontsetup.dll, 2: MUILanguageCleanup.dll, 3: MuiUnattend.exe, 4: MultiDigiMon.exe, 5: mycomput.dll, 6: mydocs.dll, 7: Mystify.scr, 8: NAPCLCFG.MSC, 9: NAPCRYPT.DLL, 10: napdsnap.dll, 11: NAPHLPR.DLL, 12: NapiNSP.dll, 13: napipsec.dll, 14: NAPMONTR.DLL, 15: NAPSTAT.EXE, 16: Narrator.exe, 17: NativeHooks.dll, 18: NaturalLanguage6.dll, 19: nb-NO, 20: nbtstat.exe, 21: NcdProp.dll, 22: nci.dll, 23: ncobjapi.dll, 24: ncpa.cpl, 25: ncrypt.dll, 26: ncryptui.dll, 27: ncsi.dll, 28: ndadmin.exe, 29: nddeapi.dll, 30: NDF, 31: ndfapi.dll, 32: ndfetw.dll, 33: NdfEventView.xml</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4887368 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: ndfhcdiscovery.dll, 1: ndiscapCfg.dll, 2: ndishc.dll, 3: ndproxystub.dll, 4: ndptsp.tsp, 5: negoexts.dll, 6: net.exe, 7: net1.exe, 8: netapi.dll, 9: netapi32.dll, 10: netbios.dll, 11: netbtugc.exe, 12: netcenter.dll, 13: netcfg.exe, 14: netcfgx.dll, 15: netcorehc.dll, 16: netdiagfx.dll, 17: netevent.dll, 18: netfxperf.dll, 19: neth.dll, 20: netid.dll, 21: netiohlp.dll, 22: netiougc.exe, 23: netjoin.dll, 24: netlogon.dll, 25: netman.dll, 26: netmsg.dll, 27: netplwiz.dll, 28: Netplwiz.exe, 29: netprof.dll, 30: netprofm.dll, 31: NetProj.exe, 32: NetProjW.dll, 33: netsh.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4887766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: netshell.dll, 1: NETSTAT.EXE, 2: nettrace.dll, 3: NetTrace.PLA.Diagnostics.xml, 4: netutils.dll, 5: networkexplorer.dll, 6: networkitemfactory.dll, 7: NetworkList, 8: networkmap.dll, 9: Network_LLU.log, 10: newdev.dll, 11: newdev.exe, 12: nl-NL, 13: nlaapi.dll, 14: nlahc.dll, 15: nlasvc.dll, 16: nlhtml.dll, 17: nlmgp.dll, 18: nlmsprep.dll, 19: nlsbres.dll, 20: NlsData0000.dll, 21: NlsData0001.dll, 22: NlsData0002.dll, 23: NlsData0003.dll, 24: NlsData0007.dll, 25: NlsData0009.dll, 26: NlsData000a.dll, 27: NlsData000c.dll, 28: NlsData000d.dll, 29: NlsData000f.dll, 30: NlsData0010.dll, 31: NlsData0011.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4888265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: NlsData0013.dll, 1: NlsData0018.dll, 2: NlsData0019.dll, 3: NlsData001a.dll, 4: NlsData001b.dll, 5: NlsData001d.dll, 6: NlsData0020.dll, 7: NlsData0021.dll, 8: NlsData0022.dll, 9: NlsData0024.dll, 10: NlsData0026.dll, 11: NlsData0027.dll, 12: NlsData002a.dll, 13: NlsData0039.dll, 14: NlsData003e.dll, 15: NlsData0045.dll, 16: NlsData0046.dll, 17: NlsData0047.dll, 18: NlsData0049.dll, 19: NlsData004a.dll, 20: NlsData004b.dll, 21: NlsData004c.dll, 22: NlsData004e.dll, 23: NlsData0414.dll, 24: NlsData0416.dll, 25: NlsData0816.dll, 26: NlsData081a.dll, 27: NlsData0c1a.dll, 28: Nlsdl.dll, 29: nlsfunc.exe, 30: NlsLexicons0001.dll, 31: NlsLexicons0002.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4888680 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: NlsLexicons0003.dll, 1: NlsLexicons0007.dll, 2: NlsLexicons0009.dll, 3: NlsLexicons000a.dll, 4: NlsLexicons000c.dll, 5: NlsLexicons000d.dll, 6: NlsLexicons000f.dll, 7: NlsLexicons0010.dll, 8: NlsLexicons0011.dll, 9: NlsLexicons0013.dll, 10: NlsLexicons0018.dll, 11: NlsLexicons0019.dll, 12: NlsLexicons001a.dll, 13: NlsLexicons001b.dll, 14: NlsLexicons001d.dll, 15: NlsLexicons0020.dll, 16: NlsLexicons0021.dll, 17: NlsLexicons0022.dll, 18: NlsLexicons0024.dll, 19: NlsLexicons0026.dll, 20: NlsLexicons0027.dll, 21: NlsLexicons002a.dll, 22: NlsLexicons0039.dll, 23: NlsLexicons003e.dll, 24: NlsLexicons0045.dll, 25: NlsLexicons0046.dll, 26: NlsLexicons0047.dll, 27: NlsLexicons0049.dll, 28: NlsLexicons004a.dll, 29: NlsLexicons004b.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4889055 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: NlsLexicons004c.dll, 1: NlsLexicons004e.dll, 2: NlsLexicons0414.dll, 3: NlsLexicons0416.dll, 4: NlsLexicons0816.dll, 5: NlsLexicons081a.dll, 6: NlsLexicons0c1a.dll, 7: NlsModels0011.dll, 8: nltest.exe, 9: NOISE.CHS, 10: NOISE.CHT, 11: NOISE.DAT, 12: noise.jpn, 13: noise.kor, 14: NOISE.THA, 15: normaliz.dll, 16: normidna.nls, 17: normnfc.nls, 18: normnfd.nls, 19: normnfkc.nls, 20: normnfkd.nls, 21: notepad.exe, 22: npmproxy.dll, 23: nrpsrv.dll, 24: nshhttp.dll, 25: nshipsec.dll, 26: nshwfp.dll, 27: nsi.dll, 28: nsisvc.dll, 29: nslookup.exe, 30: ntdll.dll, 31: NTDOS.SYS, 32: NTDOS404.SYS</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4889510 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: NTDOS411.SYS, 1: NTDOS412.SYS, 2: NTDOS804.SYS, 3: ntdsapi.dll, 4: NTIO.SYS, 5: NTIO404.SYS, 6: NTIO411.SYS, 7: NTIO412.SYS, 8: NTIO804.SYS, 9: ntkrnlpa.exe, 10: ntlanman.dll, 11: ntlanui2.dll, 12: ntmarta.dll, 13: ntoskrnl.exe, 14: ntprint.dll, 15: ntprint.exe, 16: ntshrui.dll, 17: ntvdm.exe, 18: ntvdmd.dll, 19: nvd3dum.dll, 20: nvwgf2um.dll, 21: objsel.dll, 22: occache.dll, 23: ocsetapi.dll, 24: ocsetup.exe, 25: odbc16gt.dll, 26: odbc32.dll, 27: odbc32gt.dll, 28: odbcad32.exe, 29: odbcbcp.dll, 30: odbcconf.dll, 31: odbcconf.exe, 32: odbcconf.rsp, 33: odbccp32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4889941 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: odbccr32.dll, 1: odbccu32.dll, 2: odbcint.dll, 3: odbcji32.dll, 4: odbcjt32.dll, 5: odbctrac.dll, 6: oddbse32.dll, 7: odexl32.dll, 8: odfox32.dll, 9: odpdx32.dll, 10: odtext32.dll, 11: Oemdspif.dll, 12: offfilt.dll, 13: oflc.rs, 14: ogldrv.dll, 15: ole2.dll, 16: ole2disp.dll, 17: ole2nls.dll, 18: ole32.dll, 19: oleacc.dll, 20: oleacchooks.dll, 21: oleaccrc.dll, 22: oleaut32.dll, 23: olecli.dll, 24: olecli32.dll, 25: oledlg.dll, 26: oleprn.dll, 27: olepro32.dll, 28: oleres.dll, 29: OLESVR.DLL, 30: olesvr32.dll, 31: olethk32.dll, 32: onex.dll, 33: onexui.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4890340 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: OnLineIDCpl.dll, 1: onlinesetup.cmd, 2: oobe, 3: OobeFldr.dll, 4: OpcServices.dll, 5: OpenCL.dll, 6: openfiles.exe, 7: opengl32.dll, 8: OpenVideo.dll, 9: OptionalFeatures.exe, 10: osbaseln.dll, 11: osk.exe, 12: osuninst.dll, 13: OVDecoder.dll, 14: P2P.dll, 15: p2pcollab.dll, 16: P2PGraph.dll, 17: p2phost.exe, 18: p2pnetsh.dll, 19: p2psvc.dll, 20: packager.dll, 21: panmap.dll, 22: PATHPING.EXE, 23: pautoenr.dll, 24: pcadm.dll, 25: pcaevts.dll, 26: pcalua.exe, 27: pcasvc.dll, 28: pcaui.dll, 29: pcaui.exe, 30: pcawrk.exe, 31: PCDLIB32.DLL, 32: pcl.sep, 33: pcwrun.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4890763 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: pcwum.dll, 1: pcwutl.dll, 2: pdh.dll, 3: pdhui.dll, 4: PeerDist.dll, 5: PeerDistHttpTrans.dll, 6: PeerDistSh.dll, 7: PeerDistSvc.dll, 8: PeerDistWSDDiscoProv.dll, 9: pegi-fi.rs, 10: pegi-pt.rs, 11: pegi.rs, 12: pegibbfc.rs, 13: perfc009.dat, 14: PerfCenterCPL.dll, 15: PerfCenterCpl.ico, 16: perfctrs.dll, 17: perfd009.dat, 18: perfdisk.dll, 19: perfh009.dat, 20: perfi009.dat, 21: perfmon.exe, 22: perfmon.msc, 23: perfnet.dll, 24: perfos.dll, 25: perfproc.dll, 26: PerfStringBackup.INI, 27: perftrack.dll, 28: perfts.dll, 29: phon.ime, 30: PhotoMetadataHandler.dll, 31: PhotoScreensaver.scr, 32: photowiz.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4891167 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: pid.dll, 1: pidgenx.dll, 2: pifmgr.dll, 3: PING.EXE, 4: pintlgnt.ime, 5: PkgMgr.exe, 6: pku2u.dll, 7: pl-PL, 8: pla.dll, 9: plasrv.exe, 10: PlaySndSrv.dll, 11: pmcsnap.dll, 12: pmspl.dll, 13: pngfilt.dll, 14: pnidui.dll, 15: pnpsetup.dll, 16: pnpts.dll, 17: pnpui.dll, 18: PnPUnattend.exe, 19: PnPutil.exe, 20: PNPXAssoc.dll, 21: PNPXAssocPrx.dll, 22: pnrpauto.dll, 23: Pnrphc.dll, 24: pnrpnsp.dll, 25: pnrpsvc.dll, 26: polstore.dll, 27: poqexec.exe, 28: PortableDeviceApi.dll, 29: PortableDeviceClassExtension.dll, 30: PortableDeviceConnectApi.dll, 31: PortableDeviceStatus.dll, 32: PortableDeviceSyncProvider.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4891625 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: PortableDeviceTypes.dll, 1: PortableDeviceWiaCompat.dll, 2: PortableDeviceWMDRM.dll, 3: pots.dll, 4: powercfg.cpl, 5: powercfg.exe, 6: powercpl.dll, 7: powrprof.dll, 8: ppcsnap.dll, 9: PresentationCFFRasterizerNative_v0300.dll, 10: PresentationHost.exe, 11: PresentationHostProxy.dll, 12: PresentationNative_v0300.dll, 13: PresentationSettings.exe, 14: prevhost.exe, 15: prflbmsg.dll, 16: print.exe, 17: PrintBrmUi.exe, 18: printfilterpipelineprxy.dll, 19: printfilterpipelinesvc.exe, 20: Printing_Admin_Scripts, 21: PrintIsolationHost.exe, 22: PrintIsolationProxy.dll, 23: printmanagement.msc, 24: printui.dll, 25: printui.exe, 26: prncache.dll, 27: prnfldr.dll, 28: prnntfy.dll, 29: prntvpt.dll, 30: procinst.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4892078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: profapi.dll, 1: profprov.dll, 2: profsvc.dll, 3: propsys.dll, 4: proquota.exe, 5: provsvc.dll, 6: provthrd.dll, 7: psapi.dll, 8: psbase.dll, 9: pscript.sep, 10: PSHED.DLL, 11: psisdecd.dll, 12: psisrndr.ax, 13: psr.exe, 14: pstorec.dll, 15: pstorsvc.dll, 16: pt-BR, 17: pt-PT, 18: puiapi.dll, 19: puiobj.dll, 20: PushPrinterConnections.exe, 21: pwrshplugin.dll, 22: QAGENT.DLL, 23: QAGENTRT.DLL, 24: qappsrv.exe, 25: qasf.dll, 26: qcap.dll, 27: QCLIPROV.DLL, 28: qdv.dll, 29: qdvd.dll, 30: qedit.dll, 31: qedwipes.dll, 32: qintlgnt.ime, 33: qmgr.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4892709 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: qmgrprxy.dll, 1: qprocess.exe, 2: QSHVHOST.DLL, 3: QSVRMGMT.DLL, 4: quartz.dll, 5: Query.dll, 6: query.exe, 7: quick.ime, 8: quser.exe, 9: QUTIL.DLL, 10: qwave.dll, 11: qwinsta.exe, 12: RacEngn.dll, 13: RaCertMgr.dll, 14: RaCoInst.dat, 15: racpldlg.dll, 16: RacRules.xml, 17: radardt.dll, 18: radarrs.dll, 19: RAEXTUI.dll, 20: RAIHV.dll, 21: RaLanguages, 22: ras, 23: rasadhlp.dll, 24: rasapi32.dll, 25: rasauto.dll, 26: rasautou.exe, 27: rascfg.dll, 28: raschap.dll, 29: rasctrnm.h, 30: rasctrs.dll, 31: rasdiag.dll, 32: rasdial.exe, 33: rasdlg.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4893590 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: raserver.exe, 1: rasgcw.dll, 2: rasman.dll, 3: rasmans.dll, 4: rasmbmgr.dll, 5: RASMM.dll, 6: rasmontr.dll, 7: rasmxs.dll, 8: rasphone.exe, 9: rasplap.dll, 10: rasppp.dll, 11: rasser.dll, 12: rastapi.dll, 13: rastls.dll, 14: rdpcfgex.dll, 15: rdpclip.exe, 16: rdpcore.dll, 17: rdpcorekmts.dll, 18: rdpcorets.dll, 19: rdpd3d.dll, 20: rdpdd.dll, 21: RDPENCDD.dll, 22: rdpencom.dll, 23: rdpendp.dll, 24: rdpinit.exe, 25: RDPREFDD.dll, 26: rdprefdrvapi.dll, 27: rdpshell.exe, 28: rdpsign.exe, 29: rdpudd.dll, 30: rdpwsx.dll, 31: rdrleakdiag.exe, 32: RDVGHelper.exe, 33: ReAgent.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4894010 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: ReAgentc.exe, 1: RealMediaSplitter.ax, 2: recdisc.exe, 3: recover.exe, 4: Recovery, 5: recovery.dll, 6: redir.exe, 7: reg.exe, 8: regapi.dll, 9: RegCtrl.dll, 10: regedt32.exe, 11: regidle.dll, 12: regini.exe, 13: RegisterIEPKEYs.exe, 14: regsvc.dll, 15: regsvr32.exe, 16: rekeywiz.exe, 17: relog.exe, 18: RelPost.exe, 19: remotepg.dll, 20: remotesp.tsp, 21: rendezvousSession.tlb, 22: repair-bde.exe, 23: replace.exe, 24: RESAMPLEDMO.DLL, 25: reset.exe, 26: resmon.exe, 27: RestartManager.mof, 28: RestartManagerUninstall.mof, 29: restore, 30: resutils.dll, 31: rgb9rast.dll, 32: Ribbons.scr</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4894420 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: riched20.dll, 1: riched32.dll, 2: richtx32.ocx, 3: RMActivate.exe, 4: RMActivate_isv.exe, 5: RMActivate_ssp.exe, 6: RMActivate_ssp_isv.exe, 7: RmClient.exe, 8: rnr20.dll, 9: ro-RO, 10: Robocopy.exe, 11: ROUTE.EXE, 12: RpcDiag.dll, 13: RpcEpMap.dll, 14: rpchttp.dll, 15: RPCNDFP.dll, 16: RpcNs4.dll, 17: rpcnsh.dll, 18: RpcPing.exe, 19: rpcrt4.dll, 20: RpcRtRemote.dll, 21: rpcss.dll, 22: rrinstaller.exe, 23: rsaenh.dll, 24: rshx32.dll, 25: rsop.msc, 26: RstrtMgr.dll, 27: rstrui.exe, 28: rtffilt.dll, 29: RTLExtUI.dll, 30: Rtlihvs.dll, 31: rtm.dll, 32: RtNicProp32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4894845 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: RTNUninst32.dll, 1: rtutils.dll, 2: ru-RU, 3: runas.exe, 4: rundll32.exe, 5: RunLegacyCPLElevated.exe, 6: runonce.exe, 7: rwinsta.exe, 8: samcli.dll, 9: samlib.dll, 10: SampleRes.dll, 11: samsrv.dll, 12: sas.dll, 13: sbe.dll, 14: sbeio.dll, 15: sberes.dll, 16: sbunattend.exe, 17: sc.exe, 18: scansetting.dll, 19: SCardDlg.dll, 20: SCardSvr.dll, 21: ScavengeSpace.xml, 22: scavengeui.dll, 23: sccls.dll, 24: scecli.dll, 25: scesrv.dll, 26: scext.dll, 27: schannel.dll, 28: schedcli.dll, 29: schedsvc.dll, 30: schtasks.exe, 31: scksp.dll, 32: scripto.dll, 33: scrnsave.scr</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4895274 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: scrobj.dll, 1: scrptadm.dll, 2: scrrun.dll, 3: sdautoplay.dll, 4: sdbinst.exe, 5: sdchange.exe, 6: sdclt.exe, 7: sdcpl.dll, 8: sdengin2.dll, 9: sdhcinst.dll, 10: sdiageng.dll, 11: sdiagnhost.exe, 12: sdiagprv.dll, 13: sdiagschd.dll, 14: sdohlp.dll, 15: sdrsvc.dll, 16: sdshext.dll, 17: SearchFilterHost.exe, 18: SearchFolder.dll, 19: SearchIndexer.exe, 20: SearchProtocolHost.exe, 21: SecEdit.exe, 22: sechost.dll, 23: secinit.exe, 24: seclogon.dll, 25: secpol.msc, 26: secproc.dll, 27: secproc_isv.dll, 28: secproc_ssp.dll, 29: secproc_ssp_isv.dll, 30: secur32.dll, 31: security.dll, 32: sendmail.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4895684 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: Sens.dll, 1: SensApi.dll, 2: SensorsApi.dll, 3: SensorsClassExtension.dll, 4: SensorsCpl.dll, 5: sensrsvc.dll, 6: serialui.dll, 7: services.exe, 8: services.msc, 9: serwvdrv.dll, 10: SessEnv.dll, 11: setbcdlocale.dll, 12: sethc.exe, 13: SetIEInstalledDate.exe, 14: setspn.exe, 15: Setup, 16: setupapi.dll, 17: setupcl.exe, 18: setupcln.dll, 19: setupetw.dll, 20: setupSNK.exe, 21: setupugc.exe, 22: setver.exe, 23: setx.exe, 24: sfc.dll, 25: sfc.exe, 26: sfc_os.dll, 27: shacct.dll, 28: shadow.exe, 29: share.exe, 30: sharemediacpl.dll, 31: shdocvw.dll, 32: SHELL.DLL, 33: shell32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4896158 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: shellstyle.dll, 1: shfolder.dll, 2: shgina.dll, 3: ShiftJIS.uce, 4: shimeng.dll, 5: shimgvw.dll, 6: shlwapi.dll, 7: shpafact.dll, 8: shrpubw.exe, 9: shsetup.dll, 10: shsvcs.dll, 11: shunimpl.dll, 12: shutdown.exe, 13: shwebsvc.dll, 14: signdrv.dll, 15: sigverif.exe, 16: simpdata.tlb, 17: sisbkup.dll, 18: sk-SK, 19: sl-SI, 20: slc.dll, 21: slcext.dll, 22: slmgr, 23: slmgr.vbs, 24: SlotMaximizerAg.dll, 25: SlotMaximizerBe.dll, 26: slui.exe, 27: slwga.dll, 28: SmartcardCredentialProvider.dll, 29: SMBHelperClass.dll, 30: SMI, 31: SmiEngine.dll, 32: smss.exe, 33: SndVol.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4896729 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: SndVolSSO.dll, 1: SnippingTool.exe, 2: snmpapi.dll, 3: snmptrap.exe, 4: SNTSearch.dll, 5: softkbd.dll, 6: softpub.dll, 7: sort.exe, 8: SortServer2003Compat.dll, 9: SortWindows6Compat.dll, 10: sound.drv, 11: SoundRecorder.exe, 12: spbcd.dll, 13: spcinstrumentation.man, 14: spcmsg.dll, 15: Speech, 16: sperror.dll, 17: spfileq.dll, 18: SPIN32.OCX, 19: SPInf.dll, 20: spinstall.exe, 21: spnet.dll, 22: spool, 23: spoolss.dll, 24: spoolsv.exe, 25: spopk.dll, 26: spp, 27: spp.dll, 28: sppc.dll, 29: sppcc.dll, 30: sppcext.dll, 31: sppcomapi.dll, 32: sppcommdlg.dll, 33: sppinst.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4897168 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: sppnp.dll, 1: sppobjs.dll, 2: sppsvc.exe, 3: sppui, 4: sppuinotify.dll, 5: sppwinob.dll, 6: sppwmi.dll, 7: spreview.exe, 8: spwinsat.dll, 9: spwizeng.dll, 10: spwizimg.dll, 11: spwizres.dll, 12: spwizui.dll, 13: spwmp.dll, 14: sqlceoledb30.dll, 15: sqlceqp30.dll, 16: sqlcese30.dll, 17: sqlsrv32.dll, 18: sqlsrv32.rll, 19: sqlunirl.dll, 20: sqlwid.dll, 21: sqlwoa.dll, 22: sqmapi.dll, 23: sr-Latn-CS, 24: srchadmin.dll, 25: srclient.dll, 26: srcore.dll, 27: srdelayed.exe, 28: srhelper.dll, 29: SrpUxNativeSnapIn.dll, 30: srrstr.dll, 31: srvcli.dll, 32: srvsvc.dll, 33: srwmi.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4897573 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: sscore.dll, 1: ssdpapi.dll, 2: ssdpsrv.dll, 3: ssleay32.dll, 4: sspicli.dll, 5: sspisrv.dll, 6: SSShim.dll, 7: ssText3d.scr, 8: sstpsvc.dll, 9: stclient.dll, 10: stdole2.tlb, 11: stdole32.tlb, 12: sti.dll, 13: StikyNot.exe, 14: sti_ci.dll, 15: stobject.dll, 16: storage.dll, 17: StorageContextHandler.dll, 18: Storprop.dll, 19: StorSvc.dll, 20: streamci.dll, 21: STRING32.dll, 22: StructuredQuery.dll, 23: SubRange.uce, 24: subst.exe, 25: sud.dll, 26: sv-SE, 27: svchost.exe, 28: swprv.dll, 29: sxproxy.dll, 30: sxs.dll, 31: sxshared.dll, 32: sxssrv.dll, 33: sxsstore.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4897998 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: sxstrace.exe, 1: SyncCenter.dll, 2: synceng.dll, 3: SyncHost.exe, 4: SyncHostps.dll, 5: SyncInfrastructure.dll, 6: SyncInfrastructureps.dll, 7: Syncreg.dll, 8: syncui.dll, 9: sysclass.dll, 10: sysdm.cpl, 11: sysedit.exe, 12: SysFxUI.dll, 13: SYSINFO.OCX, 14: syskey.exe, 15: sysmain.dll, 16: sysmon.ocx, 17: sysntfy.dll, 18: sysprep, 19: sysprepMCE.dll, 20: sysprint.sep, 21: sysprtj.sep, 22: syssetup.dll, 23: system.drv, 24: systemcpl.dll, 25: systeminfo.exe, 26: SystemPropertiesAdvanced.exe, 27: SystemPropertiesComputerName.exe, 28: SystemPropertiesDataExecutionPrevention.exe, 29: SystemPropertiesHardware.exe, 30: SystemPropertiesPerformance.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4898402 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: SystemPropertiesProtection.exe, 1: SystemPropertiesRemote.exe, 2: systemsf.ebd, 3: systray.exe, 4: t2embed.dll, 5: Tabbtn.dll, 6: TabbtnEx.dll, 7: tabcal.exe, 8: tabctl32.ocx, 9: TabletPC.cpl, 10: TabSvc.dll, 11: takeown.exe, 12: tapi.dll, 13: tapi3.dll, 14: tapi32.dll, 15: tapilua.dll, 16: TapiMigPlugin.dll, 17: tapiperf.dll, 18: tapisrv.dll, 19: TapiSysprep.dll, 20: tapiui.dll, 21: TapiUnattend.exe, 22: taskbarcpl.dll, 23: taskcomp.dll, 24: taskeng.exe, 25: taskhost.exe, 26: taskkill.exe, 27: tasklist.exe, 28: taskmgr.exe, 29: Tasks, 30: taskschd.dll, 31: taskschd.msc, 32: TaskSchdPS.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4898809 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: tbs.dll, 1: tbssvc.dll, 2: tcmsetup.exe, 3: tcpbidi.xml, 4: tcpipcfg.dll, 5: tcpmib.dll, 6: tcpmon.dll, 7: tcpmon.ini, 8: tcpmonui.dll, 9: TCPSVCS.EXE, 10: tdc.ocx, 11: tdh.dll, 12: Tegomm32.ocx, 13: Tegowav3.ocx, 14: telephon.cpl, 15: temp.000, 16: termmgr.dll, 17: termsrv.dll, 18: th-TH, 19: thawbrkr.dll, 20: themecpl.dll, 21: themeservice.dll, 22: themeui.dll, 23: THREED32.OCX, 24: thumbcache.dll, 25: ticrf.rat, 26: timedate.cpl, 27: TimeDateMUICallback.dll, 28: timeout.exe, 29: TIMER.DRV, 30: tintlgnt.ime, 31: tlscsp.dll, 32: TOOLHELP.DLL, 33: tpm.msc</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4899222 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: tpmcompc.dll, 1: TpmInit.exe, 2: tquery.dll, 3: tr-TR, 4: tracerpt.exe, 5: TRACERT.EXE, 6: traffic.dll, 7: TRAPI.dll, 8: tree.com, 9: trkwks.dll, 10: tsbyuv.dll, 11: tscfgwmi.dll, 12: TSChannel.dll, 13: tscon.exe, 14: tsddd.dll, 15: tsdiscon.exe, 16: TSErrRedir.dll, 17: tsgqec.dll, 18: tskill.exe, 19: tsmf.dll, 20: TSpkg.dll, 21: TsPnPRdrCoInstaller.dll, 22: tspubwmi.dll, 23: tssrvlic.dll, 24: TSTheme.exe, 25: TsUsbGDCoInstaller.dll, 26: TsUsbRedirectionGroupPolicyControl.exe, 27: TsUsbRedirectionGroupPolicyExtension.dll, 28: TSWbPrxy.exe, 29: TSWorkspace.dll, 30: TsWpfWrp.exe, 31: tvratings.dll, 32: twext.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4899691 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: txflog.dll, 1: txfw32.dll, 2: typelib.dll, 3: typeperf.exe, 4: tzres.dll, 5: tzutil.exe, 6: ubpm.dll, 7: ucmhc.dll, 8: ucsvc.exe, 9: udhisapi.dll, 10: uDWM.dll, 11: uexfat.dll, 12: ufat.dll, 13: UI0Detect.exe, 14: UIAnimation.dll, 15: UIAutomationCore.dll, 16: uicom.dll, 17: UIHub.dll, 18: UIRibbon.dll, 19: UIRibbonRes.dll, 20: uk-UA, 21: ulib.dll, 22: umb.dll, 23: umdmxfrm.dll, 24: umpnpmgr.dll, 25: umpo.dll, 26: umrdp.dll, 27: umstartup.etl, 28: umstartup000.etl, 29: unattend.dll, 30: unicows.dll, 31: unimdm.tsp, 32: unimdmat.dll, 33: uniplat.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4900205 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: unlodctr.exe, 1: unrar.dll, 2: unregmp2.exe, 3: untfs.dll, 4: upnp.dll, 5: upnpcont.exe, 6: upnphost.dll, 7: ureg.dll, 8: url.dll, 9: urlmon.dll, 10: usbceip.dll, 11: usbmon.dll, 12: usbperf.dll, 13: usbui.dll, 14: USER.EXE, 15: user32.dll, 16: UserAccountControlSettings.dll, 17: UserAccountControlSettings.exe, 18: usercpl.dll, 19: userenv.dll, 20: userinit.exe, 21: usk.rs, 22: usp10.dll, 23: utildll.dll, 24: Utilman.exe, 25: uudf.dll, 26: UXInit.dll, 27: uxlib.dll, 28: uxlibres.dll, 29: uxsms.dll, 30: uxtheme.dll, 31: v7vga.rom, 32: VAN.dll, 33: Vault.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4900653 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: vaultcli.dll, 1: VaultCmd.exe, 2: VaultCredProvider.dll, 3: vaultsvc.dll, 4: VaultSysUi.exe, 5: vbajet32.dll, 6: VBICodec.ax, 7: vbisurf.ax, 8: vbscript.dll, 9: vccorlib110.dll, 10: vcl50.bpl, 11: vclx50.bpl, 12: vcomp100.dll, 13: vdmdbg.dll, 14: vdmredir.dll, 15: vds.exe, 16: vdsbas.dll, 17: vdsdyn.dll, 18: vdsldr.exe, 19: vdsutil.dll, 20: vdsvd.dll, 21: vds_ps.dll, 22: ver.dll, 23: verclsid.exe, 24: verifier.dll, 25: verifier.exe, 26: version.dll, 27: vfpodbc.dll, 28: vfwwdm32.dll, 29: vga.dll, 30: vga.drv, 31: vga256.dll, 32: vga64k.dll, 33: vidcap.ax</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4901059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: VIDRESZR.DLL, 1: virtdisk.dll, 2: VmbusCoinstaller.dll, 3: vmbuspipe.dll, 4: vmbusres.dll, 5: VmdCoinstall.dll, 6: vmicres.dll, 7: vmicsvc.exe, 8: vmictimeprovider.dll, 9: Vmscnt3.dll, 10: vmstorfltres.dll, 11: vobsub.dll, 12: vpnike.dll, 13: vpnikeapi.dll, 14: vssadmin.exe, 15: vssapi.dll, 16: vsstrace.dll, 17: VSSVC.exe, 18: vss_ps.dll, 19: w32time.dll, 20: w32tm.exe, 21: w32topl.dll, 22: WABSyncProvider.dll, 23: waitfor.exe, 24: WavDest.dll, 25: wavemsp.dll, 26: wbadmin.exe, 27: wbem, 28: wbemcomn.dll, 29: wbengine.exe, 30: wbiosrvc.dll, 31: WCN, 32: WcnApi.dll, 33: wcncsvc.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4901483 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: WcnEapAuthProxy.dll, 1: WcnEapPeerProxy.dll, 2: WcnNetsh.dll, 3: wcnwiz.dll, 4: WcsPlugInService.dll, 5: wdc.dll, 6: wdi, 7: wdi.dll, 8: wdiasqmmodule.dll, 9: wdigest.dll, 10: wdmaud.drv, 11: wdscore.dll, 12: WdsUnattendTemplate.xml, 13: WEB.rs, 14: webcheck.dll, 15: WebClnt.dll, 16: webio.dll, 17: webservices.dll, 18: wecapi.dll, 19: wecsvc.dll, 20: wecutil.exe, 21: wer.dll, 22: werconcpl.dll, 23: wercplsupport.dll, 24: werdiagcontroller.dll, 25: WerFault.exe, 26: WerFaultSecure.exe, 27: wermgr.exe, 28: wersvc.dll, 29: werui.dll, 30: wevtapi.dll, 31: wevtfwd.dll, 32: wevtsvc.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4901887 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: wevtutil.exe, 1: wextract.exe, 2: WF.msc, 3: wfapigp.dll, 4: WfHC.dll, 5: wfp, 6: WFS.exe, 7: WFSR.dll, 8: WFWNET.DRV, 9: whealogr.dll, 10: where.exe, 11: whhelper.dll, 12: whoami.exe, 13: wiaacmgr.exe, 14: wiaaut.dll, 15: wiadefui.dll, 16: wiadss.dll, 17: wiarpc.dll, 18: wiascanprofiles.dll, 19: wiaservc.dll, 20: wiashext.dll, 21: wiatrace.dll, 22: wiavideo.dll, 23: WIFEMAN.DLL, 24: wimgapi.dll, 25: wimserv.exe, 26: win.com, 27: win32k.sys, 28: win32spl.dll, 29: win87em.dll, 30: winbio.dll, 31: WinBioDatabase, 32: WinBioPlugIns, 33: winbrand.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4902326 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: wincredprovider.dll, 1: WindowsAccessBridge.dll, 2: WindowsCodecs.dll, 3: WindowsCodecsExt.dll, 4: WindowsPowerShell, 5: winethc.dll, 6: winevt, 7: WinFax.dll, 8: winhttp.dll, 9: wininet.dll, 10: wininit.exe, 11: winipsec.dll, 12: winload.exe, 13: winlogon.exe, 14: winmm.dll, 15: WINNLS.DLL, 16: winnsi.dll, 17: WINOLDAP.MOD, 18: winresume.exe, 19: winrm, 20: winrm.cmd, 21: winrm.vbs, 22: winrnr.dll, 23: winrs.exe, 24: winrscmd.dll, 25: winrshost.exe, 26: winrsmgr.dll, 27: winrssrv.dll, 28: WinSAT.exe, 29: WinSATAPI.dll, 30: WinSCard.dll, 31: winshfhc.dll, 32: WINSOCK.DLL, 33: winsockhc.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4902749 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: winspool.drv, 1: WINSPOOL.EXE, 2: WINSRPC.DLL, 3: winsrv.dll, 4: winsta.dll, 5: WinSync.dll, 6: WinSyncMetastore.dll, 7: WinSyncProviders.dll, 8: wintrust.dll, 9: winusb.dll, 10: winver.exe, 11: wisptis.exe, 12: wkscli.dll, 13: wksprt.exe, 14: wksprtPS.dll, 15: wkssvc.dll, 16: wlanapi.dll, 17: wlancfg.dll, 18: WLanConn.dll, 19: wlandlg.dll, 20: wlanext.exe, 21: wlangpui.dll, 22: WLanHC.dll, 23: wlanhlp.dll, 24: wlaninst.dll, 25: WlanMM.dll, 26: wlanmsm.dll, 27: wlanpref.dll, 28: wlansec.dll, 29: wlansvc.dll, 30: wlanui.dll, 31: wlanutil.dll, 32: Wldap32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4903199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: wlgpclnt.dll, 1: wlrmdr.exe, 2: WlS0WndH.dll, 3: WMADMOD.DLL, 4: WMADMOE.DLL, 5: WMALFXGFXDSP.dll, 6: WMASF.DLL, 7: wmcodecdspps.dll, 8: wmdmlog.dll, 9: wmdmps.dll, 10: wmdrmdev.dll, 11: wmdrmnet.dll, 12: wmdrmsdk.dll, 13: wmerror.dll, 14: wmi.dll, 15: wmicmiplugin.dll, 16: wmidx.dll, 17: WmiMgmt.msc, 18: wmiprop.dll, 19: WMNetMgr.dll, 20: wmp.dll, 21: wmpcm.dll, 22: WmpDui.dll, 23: wmpdxm.dll, 24: wmpeffects.dll, 25: WMPEncEn.dll, 26: WMPhoto.dll, 27: wmploc.DLL, 28: wmpmde.dll, 29: wmpps.dll, 30: wmpshell.dll, 31: wmpsrcwp.dll, 32: wmsgapi.dll, 33: WMSPDMOD.DLL</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4903622 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: WMSPDMOE.DLL, 1: WMVCORE.DLL, 2: WMVDECOD.DLL, 3: wmvdspa.dll, 4: WMVENCOD.DLL, 5: WMVSDECD.DLL, 6: WMVSENCD.DLL, 7: WMVXENCD.DLL, 8: wow32.dll, 9: WOWDEB.EXE, 10: WOWEXEC.EXE, 11: Wpc.dll, 12: wpcao.dll, 13: wpccpl.dll, 14: wpcmig.dll, 15: wpcsvc.dll, 16: wpcumi.dll, 17: wpdbusenum.dll, 18: wpdshext.dll, 19: WPDShextAutoplay.exe, 20: WPDShServiceObj.dll, 21: WPDSp.dll, 22: wpdwcn.dll, 23: wpd_ci.dll, 24: wpnpinst.exe, 25: write.exe, 26: ws2help.dll, 27: ws2_32.dll, 28: wscapi.dll, 29: wscinterop.dll, 30: wscisvif.dll, 31: wscmisetup.dll, 32: wscproxystub.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4904059 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: wscript.exe, 1: wscsvc.dll, 2: wscui.cpl, 3: WSDApi.dll, 4: wsdchngr.dll, 5: WSDMon.dll, 6: WSDPrintProxy.DLL, 7: WSDScanProxy.dll, 8: wsecedit.dll, 9: wsepno.dll, 10: wshbth.dll, 11: wshcon.dll, 12: wshelper.dll, 13: wshext.dll, 14: wship6.dll, 15: wshirda.dll, 16: wshnetbs.dll, 17: wshom.ocx, 18: wshqos.dll, 19: wshrm.dll, 20: WSHTCPIP.DLL, 21: wsmanconfig_schema.xml, 22: WSManHTTPConfig.exe, 23: WSManMigrationPlugin.dll, 24: WsmAuto.dll, 25: wsmplpxy.dll, 26: wsmprovhost.exe, 27: WsmPty.xsl, 28: WsmRes.dll, 29: WsmSvc.dll, 30: WsmTxt.xsl, 31: WsmWmiPl.dll, 32: wsnmp32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4904466 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: wsock32.dll, 1: WSpell.ocx, 2: wsqmcons.exe, 3: WSTPager.ax, 4: wtsapi32.dll, 5: wuapi.dll, 6: wuapp.exe, 7: wuauclt.exe, 8: wuaueng.dll, 9: wucltux.dll, 10: WUDFCoinstaller.dll, 11: WUDFHost.exe, 12: WUDFPlatform.dll, 13: WUDFSvc.dll, 14: WUDFx.dll, 15: wudriver.dll, 16: wups.dll, 17: wups2.dll, 18: wusa.exe, 19: wuwebv.dll, 20: wvc.dll, 21: Wwanadvui.dll, 22: WWanAPI.dll, 23: wwancfg.dll, 24: wwanconn.dll, 25: WWanHC.dll, 26: wwaninst.dll, 27: wwanmm.dll, 28: Wwanpref.dll, 29: wwanprotdim.dll, 30: wwansvc.dll, 31: wwapi.dll, 32: wzcdlg.dll, 33: x3daudio1_0.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4904924 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: x3daudio1_1.dll, 1: X3DAudio1_2.dll, 2: X3DAudio1_3.dll, 3: X3DAudio1_4.dll, 4: X3DAudio1_5.dll, 5: X3DAudio1_6.dll, 6: X3DAudio1_7.dll, 7: xactengine2_0.dll, 8: xactengine2_1.dll, 9: xactengine2_10.dll, 10: xactengine2_2.dll, 11: xactengine2_3.dll, 12: xactengine2_4.dll, 13: xactengine2_5.dll, 14: xactengine2_6.dll, 15: xactengine2_7.dll, 16: xactengine2_8.dll, 17: xactengine2_9.dll, 18: xactengine3_0.dll, 19: xactengine3_1.dll, 20: xactengine3_2.dll, 21: xactengine3_3.dll, 22: xactengine3_4.dll, 23: xactengine3_5.dll, 24: xactengine3_6.dll, 25: xactengine3_7.dll, 26: XAPOFX1_0.dll, 27: XAPOFX1_1.dll, 28: XAPOFX1_2.dll, 29: XAPOFX1_3.dll, 30: XAPOFX1_4.dll, 31: XAPOFX1_5.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4905565 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: XAudio2_0.dll, 1: XAudio2_1.dll, 2: XAudio2_2.dll, 3: XAudio2_3.dll, 4: XAudio2_4.dll, 5: XAudio2_5.dll, 6: XAudio2_6.dll, 7: XAudio2_7.dll, 8: xcopy.exe, 9: xinput1_1.dll, 10: xinput1_2.dll, 11: xinput1_3.dll, 12: XInput9_1_0.dll, 13: xmlfilter.dll, 14: xmllite.dll, 15: xmlprovi.dll, 16: xolehlp.dll, 17: XpsFilt.dll, 18: XpsGdiConverter.dll, 19: XpsPrint.dll, 20: XpsRasterService.dll, 21: xpsrchvw.exe, 22: xpsrchvw.xml, 23: xpsservices.dll, 24: XPSSHHDR.dll, 25: xpssvcs.dll, 26: xvid.ax, 27: xvidcore.dll, 28: xvidvfw.dll, 29: xwizard.dtd, 30: xwizard.exe, 31: xwizards.dll, 32: xwreg.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4906061 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail>0: xwtpdui.dll, 1: xwtpw32.dll, 2: y8cnvt.ax, 3: yv12vfw.dll, 4: zh-CN, 5: zh-HK, 6: zh-TW, 7: zipfldr.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4906282 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryDirectory</Operation>
<Path>C:\Windows\System32</Path>
<Result>NO MORE FILES</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4906376 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4907179 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4956290 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4956406 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 360,448, EndOfFile: 360,448, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4956455 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 360,448, EndOfFile: 360,448, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4956495 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>ReadFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>Offset: 359,424, Length: 1,024, Priority: Normal</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4956732 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.4981052 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\system32\ui\SwDRM.dll</Path>
<Result>PATH NOT FOUND</Result>
<Detail>Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5002009 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QuerySecurityFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>Information: Owner, Group, DACL, SACL, Label</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5002117 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryBasicInformationFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail>CreationTime: 7/13/2009 1:27:32 PM, LastAccessTime: 7/13/2009 1:27:32 PM, LastWriteTime: 7/13/2009 3:14:44 PM, ChangeTime: 11/13/2011 6:57:01 AM, FileAttributes: A</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5003289 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5003766 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Query Value, Enumerate Sub Keys</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5004008 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DisableLocalOverride</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 1,024</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5004078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegOpenKey</Operation>
<Path>HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Read</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5004283 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegQueryValue</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide\PreferExternalManifest</Path>
<Result>NAME NOT FOUND</Result>
<Detail>Length: 20</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5004337 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5006652 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5007342 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5007574 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5007638 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5007673 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5007746 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5007840 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5008266 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5009042 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5009700 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>FileSystemControl</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>Control: FSCTL_READ_FILE_USN_DATA</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5009915 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5009975 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>FILE LOCKED WITH ONLY READERS</Result>
<Detail>SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5010012 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5010077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CreateFileMapping</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>SyncType: SyncTypeOther</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5010160 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryStandardInformationFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail>AllocationSize: 4,079,616, EndOfFile: 4,075,764, NumberOfLinks: 2, DeletePending: False, Directory: False</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5010732 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\AppPatch\sysmain.sdb</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:03.5010969 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\System32\WerFault.exe</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0615927 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 4908</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0617353 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 3040</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0618299 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Create</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5148</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0636822 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 4572, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0636841 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 3972, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0636914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 6008, User Time: 0.0156001, Kernel Time: 0.1248008</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0636976 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 2252, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0637089 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 4908, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0637097 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 3040, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0637186 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Thread Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Thread ID: 5148, User Time: 0.0000000, Kernel Time: 0.0000000</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0640560 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\MKV2AC3\MKV2AC3.exe</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\MKV2AC3\MKV2AC3.exe</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0640743 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.VisualBas#\c9046da345002c67f64874cd254e99d8\Microsoft.VisualBasic.ni.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0640880 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\NativeImages_v4.0.30319_32\System.Core\44a7d2597981a82da8b9e3e2298602de\System.Core.ni.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0641015 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\NativeImages_v4.0.30319_32\System\5286fe2d0167eb835a9f11025f1cb756\System.ni.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0641147 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a774bd593b8420bae4a8cf1d46af3ba2\mscorlib.ni.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0641279 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0641419 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\AppPatch\AcXtrnal.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\AppPatch\AcXtrnal.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0641570 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\AppPatch\AcGenral.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\AppPatch\AcGenral.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0641710 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\AppPatch\AcLayers.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\AppPatch\AcLayers.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0641848 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\msvcr100_clr0400.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\msvcr100_clr0400.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0641993 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0642125 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\mscoree.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\mscoree.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0642255 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\mpr.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\mpr.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0642381 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\sfc_os.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\sfc_os.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0642503 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\sfc.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\sfc.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0642635 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\winspool.drv</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\winspool.drv</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0642759 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Program Files\AVAST Software\Avast\snxhk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Program Files\AVAST Software\Avast\snxhk.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0642877 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0643006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\shunimpl.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\shunimpl.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0643136 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\SortServer2003Compat.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\SortServer2003Compat.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0643260 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\msacm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\msacm32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0643384 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\winmm.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\winmm.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0643508 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\samcli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\samcli.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0643640 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\dwmapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\dwmapi.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0643761 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\uxtheme.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\uxtheme.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0643885 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\version.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\version.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0644006 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\userenv.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\userenv.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0644141 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\sspicli.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\sspicli.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0644265 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\apphelp.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\apphelp.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0644386 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\cryptbase.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\cryptbase.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0644507 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\profapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\profapi.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0644637 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\cfgmgr32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\cfgmgr32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0644761 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\devobj.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\devobj.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0644882 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\KernelBase.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\KernelBase.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0645001 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\oleaut32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\oleaut32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0645119 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\setupapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\setupapi.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0645248 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\kernel32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\kernel32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0645364 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\usp10.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\usp10.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0645480 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\lpk.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\lpk.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0645607 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\normaliz.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\normaliz.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0645731 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\gdi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\gdi32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0645847 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\imm32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\imm32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0645963 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\sechost.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\sechost.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0646078 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\shlwapi.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\shlwapi.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0646192 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\msvcrt.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\msvcrt.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0646316 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\urlmon.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\urlmon.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0646434 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\wininet.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\wininet.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0646558 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\iertutil.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\iertutil.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0646682 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\ole32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\ole32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0646798 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\msctf.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\msctf.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0646914 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\user32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\user32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0647027 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\rpcrt4.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\rpcrt4.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0647143 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\shell32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\shell32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0647259 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\ntdll.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\ntdll.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0647372 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\advapi32.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\advapi32.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0647493 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>QueryNameInformationFile</Operation>
<Path>C:\Windows\System32\apisetschema.dll</Path>
<Result>SUCCESS</Result>
<Detail>Name: \Windows\System32\apisetschema.dll</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0647938 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>Process Exit</Operation>
<Path></Path>
<Result>SUCCESS</Result>
<Detail>Exit Status: -532462766, User Time: 0.0156001 seconds, Kernel Time: 0.1248008 seconds, Private Bytes: 15,839,232, Peak Private Bytes: 15,859,712, Working Set: 12,161,024, Peak Working Set: 12,427,264</Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0648021 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Program Files\MKV2AC3</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0648245 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Sorting\Versions</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0648280 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Session Manager</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0648382 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0648426 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0648547 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\NetworkProvider\HwOrder</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0648660 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\.NETFramework</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0648698 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0649498 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\GACChangeNotification\Default</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0649579 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v4.0.30319_32</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0649646 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\NATIVEIMAGES_V4.0.30319_32\index119.dat</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0649864 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Fusion\PublisherPolicy\Default</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0649905 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>CloseFile</Operation>
<Path>C:\Windows\assembly\pubpol4.dat</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0650053 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Locale\Alternate Sorts</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0650077 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Locale</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0650096 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\System\CurrentControlSet\Control\Nls\Language Groups</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0650153 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKCU\Software\Microsoft\Windows NT\CurrentVersion</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0650177 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>

<event>
<ProcessIndex>281</ProcessIndex>
<Time_of_Day>12:26:38.0650199 PM</Time_of_Day>
<Process_Name>MKV2AC3.exe</Process_Name>
<PID>1164</PID>
<Operation>RegCloseKey</Operation>
<Path>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options</Path>
<Result>SUCCESS</Result>
<Detail></Detail>
</event>
</eventlist></procmon>