﻿"Time of Day","Process Name","PID","Operation","Path","Result","Detail"
"6:24:32.2345155 PM","ragel.exe","5712","Thread Create","","SUCCESS","Thread ID: 5076"
"6:24:32.2453217 PM","ragel.exe","5712","QueryNameInformationFile","D:\Devel\Ragel 6.6\bin\Ragel.exe","SUCCESS","Name: \Devel\Ragel 6.6\bin\Ragel.exe"
"6:24:32.2458276 PM","ragel.exe","5712","CreateFile","C:\MinGW\msys\1.0\bin\msys-1.0.dll","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2459913 PM","ragel.exe","5712","FileSystemControl","C:\MinGW\msys\1.0\bin\msys-1.0.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"6:24:32.2461503 PM","ragel.exe","5712","CloseFile","C:\MinGW\msys\1.0\bin\msys-1.0.dll","SUCCESS",""
"6:24:32.2464517 PM","ragel.exe","5712","Load Image","D:\Devel\Ragel 6.6\bin\Ragel.exe","SUCCESS","Image Base: 0x400000, Image Size: 0xa2000"
"6:24:32.2476365 PM","ragel.exe","5712","CreateFile","D:\Devel\Ragel 6.6\bin\Ragel.exe","SUCCESS","Desired Access: Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2478893 PM","ragel.exe","5712","FileSystemControl","D:\Devel\Ragel 6.6\bin\Ragel.exe","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"6:24:32.2481111 PM","ragel.exe","5712","CloseFile","D:\Devel\Ragel 6.6\bin\Ragel.exe","SUCCESS",""
"6:24:32.2483413 PM","ragel.exe","5712","Load Image","C:\WINDOWS\system32\ntdll.dll","SUCCESS","Image Base: 0x7c900000, Image Size: 0xb2000"
"6:24:32.2483595 PM","ragel.exe","5712","QueryNameInformationFile","D:\Devel\Ragel 6.6\bin\Ragel.exe","SUCCESS","Name: \Devel\Ragel 6.6\bin\Ragel.exe"
"6:24:32.2485992 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\Prefetch\RAGEL.EXE-14A28D7F.pf","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2487201 PM","ragel.exe","5712","QueryStandardInformationFile","C:\WINDOWS\Prefetch\RAGEL.EXE-14A28D7F.pf","SUCCESS","AllocationSize: 12,288, EndOfFile: 8,856, NumberOfLinks: 1, DeletePending: False, Directory: False"
"6:24:32.2488174 PM","ragel.exe","5712","FileSystemControl","C:\WINDOWS\Prefetch\RAGEL.EXE-14A28D7F.pf","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"6:24:32.2489244 PM","ragel.exe","5712","QueryBasicInformationFile","C:\WINDOWS\Prefetch\RAGEL.EXE-14A28D7F.pf","SUCCESS","CreationTime: 3/20/2011 8:23:37 PM, LastAccessTime: 3/22/2011 6:22:44 PM, LastWriteTime: 3/22/2011 6:22:44 PM, ChangeTime: 3/22/2011 6:22:44 PM, FileAttributes: ANCI"
"6:24:32.2490283 PM","ragel.exe","5712","ReadFile","C:\WINDOWS\Prefetch\RAGEL.EXE-14A28D7F.pf","SUCCESS","Offset: 0, Length: 1,024"
"6:24:32.2491805 PM","ragel.exe","5712","CloseFile","C:\WINDOWS\Prefetch\RAGEL.EXE-14A28D7F.pf","SUCCESS",""
"6:24:32.2493546 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\Prefetch\RAGEL.EXE-14A28D7F.pf","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2494688 PM","ragel.exe","5712","QueryStandardInformationFile","C:\WINDOWS\Prefetch\RAGEL.EXE-14A28D7F.pf","SUCCESS","AllocationSize: 12,288, EndOfFile: 8,856, NumberOfLinks: 1, DeletePending: False, Directory: False"
"6:24:32.2495672 PM","ragel.exe","5712","ReadFile","C:\WINDOWS\Prefetch\RAGEL.EXE-14A28D7F.pf","SUCCESS","Offset: 0, Length: 8,856"
"6:24:32.2496976 PM","ragel.exe","5712","CloseFile","C:\WINDOWS\Prefetch\RAGEL.EXE-14A28D7F.pf","SUCCESS",""
"6:24:32.2497770 PM","ragel.exe","5712","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ragel.exe","NAME NOT FOUND","Desired Access: Read"
"6:24:32.2498063 PM","ragel.exe","5712","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Read"
"6:24:32.2498628 PM","ragel.exe","5712","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\CWDIllegalInDLLSearch","NAME NOT FOUND","Length: 1,024"
"6:24:32.2498952 PM","ragel.exe","5712","RegCloseKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS",""
"6:24:32.2501432 PM","ragel.exe","5712","FileSystemControl","D:\Devel\vvm\close","SUCCESS","Control: FSCTL_IS_VOLUME_MOUNTED"
"6:24:32.2517060 PM","ragel.exe","5712","Load Image","C:\WINDOWS\system32\kernel32.dll","SUCCESS","Image Base: 0x7c800000, Image Size: 0xf6000"
"6:24:32.2839288 PM","ragel.exe","5712","RegOpenKey","HKLM\System\CurrentControlSet\Control\Terminal Server","SUCCESS","Desired Access: Read"
"6:24:32.2839866 PM","ragel.exe","5712","RegQueryValue","HKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0"
"6:24:32.2840177 PM","ragel.exe","5712","RegCloseKey","HKLM\System\CurrentControlSet\Control\Terminal Server","SUCCESS",""
"6:24:32.2840325 PM","ragel.exe","5712","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ragel.exe","NAME NOT FOUND","Desired Access: Read"
"6:24:32.2845702 PM","ragel.exe","5712","QueryOpen","D:\Program Files\AVAST Software\Avast\snxhk.dll","SUCCESS","CreationTime: 3/7/2011 1:01:27 AM, LastAccessTime: 3/22/2011 6:24:32 PM, LastWriteTime: 2/23/2011 11:04:17 AM, ChangeTime: 3/7/2011 1:01:30 AM, AllocationSize: 200,704, EndOfFile: 197,208, FileAttributes: N"
"6:24:32.2847476 PM","ragel.exe","5712","QueryOpen","D:\Program Files\AVAST Software\Avast\snxhk.dll","SUCCESS","CreationTime: 3/7/2011 1:01:27 AM, LastAccessTime: 3/22/2011 6:24:32 PM, LastWriteTime: 2/23/2011 11:04:17 AM, ChangeTime: 3/7/2011 1:01:30 AM, AllocationSize: 200,704, EndOfFile: 197,208, FileAttributes: N"
"6:24:32.2849460 PM","ragel.exe","5712","CreateFile","D:\Program Files\AVAST Software\Avast\snxhk.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2850452 PM","ragel.exe","5712","QueryStandardInformationFile","D:\Program Files\AVAST Software\Avast\snxhk.dll","SUCCESS","AllocationSize: 200,704, EndOfFile: 197,208, NumberOfLinks: 1, DeletePending: False, Directory: False"
"6:24:32.2851346 PM","ragel.exe","5712","FileSystemControl","D:\Program Files\AVAST Software\Avast\snxhk.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"6:24:32.2852404 PM","ragel.exe","5712","CloseFile","D:\Program Files\AVAST Software\Avast\snxhk.dll","SUCCESS",""
"6:24:32.2854826 PM","ragel.exe","5712","CreateFile","D:\Program Files\AVAST Software\Avast\snxhk.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2856941 PM","ragel.exe","5712","RegOpenKey","HKLM\System\CurrentControlSet\Control\SafeBoot\Option","NAME NOT FOUND","Desired Access: Query Value, Set Value"
"6:24:32.2857232 PM","ragel.exe","5712","RegOpenKey","HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers","SUCCESS","Desired Access: Query Value"
"6:24:32.2857693 PM","ragel.exe","5712","RegQueryValue","HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled","SUCCESS","Type: REG_DWORD, Length: 4, Data: 1"
"6:24:32.2857997 PM","ragel.exe","5712","RegCloseKey","HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers","SUCCESS",""
"6:24:32.2858310 PM","ragel.exe","5712","RegOpenKey","HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers","NAME NOT FOUND","Desired Access: Query Value"
"6:24:32.2859559 PM","ragel.exe","5712","CloseFile","D:\Program Files\AVAST Software\Avast\snxhk.dll","SUCCESS",""
"6:24:32.2874396 PM","ragel.exe","5712","Load Image","D:\Program Files\AVAST Software\Avast\snxhk.dll","SUCCESS","Image Base: 0x64d00000, Image Size: 0x33000"
"6:24:32.2874930 PM","ragel.exe","5712","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed"
"6:24:32.2875519 PM","ragel.exe","5712","RegOpenKey","HKCU\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT FOUND","Desired Access: Read"
"6:24:32.2875734 PM","ragel.exe","5712","RegOpenKey","HKCU\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"6:24:32.2876067 PM","ragel.exe","5712","RegQueryValue","HKCU\Control Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"6:24:32.2876371 PM","ragel.exe","5712","RegCloseKey","HKCU\Control Panel\Desktop","SUCCESS",""
"6:24:32.2876544 PM","ragel.exe","5712","RegCloseKey","HKCU","SUCCESS",""
"6:24:32.2878371 PM","ragel.exe","5712","CreateFile","D:\Program Files\AVAST Software\Avast\snxhk.dll.2.Manifest","NAME NOT FOUND","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
"6:24:32.2879992 PM","ragel.exe","5712","CreateFile","D:\Program Files\AVAST Software\Avast\snxhk.dll.2.Manifest","NAME NOT FOUND","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
"6:24:32.2881567 PM","ragel.exe","5712","CreateFile","D:\Program Files\AVAST Software\Avast\snxhk.dll.2.Config","NAME NOT FOUND","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
"6:24:32.2883241 PM","ragel.exe","5712","CreateFile","D:\Program Files\AVAST Software\Avast\snxhk.dll.2.Config","NAME NOT FOUND","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
"6:24:32.2887973 PM","ragel.exe","5712","RegOpenKey","HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots","NAME NOT FOUND","Desired Access: Enumerate Sub Keys"
"6:24:32.2890183 PM","ragel.exe","5712","QueryOpen","D:\Devel\Ragel 6.6\bin\ragel.exe.Local","NAME NOT FOUND",""
"6:24:32.2892035 PM","ragel.exe","5712","QueryOpen","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f","SUCCESS","CreationTime: 8/15/2010 5:49:13 PM, LastAccessTime: 3/22/2011 6:24:32 PM, LastWriteTime: 8/15/2010 5:49:13 PM, ChangeTime: 8/16/2010 7:12:41 PM, AllocationSize: 0, EndOfFile: 0, FileAttributes: D"
"6:24:32.2893890 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2896245 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcp90.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2897547 PM","ragel.exe","5712","QueryStandardInformationFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcp90.dll","SUCCESS","AllocationSize: 573,440, EndOfFile: 569,680, NumberOfLinks: 1, DeletePending: False, Directory: False"
"6:24:32.2898771 PM","ragel.exe","5712","FileSystemControl","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcp90.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"6:24:32.2900120 PM","ragel.exe","5712","CloseFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcp90.dll","SUCCESS",""
"6:24:32.2902305 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcp90.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2905707 PM","ragel.exe","5712","CloseFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcp90.dll","SUCCESS",""
"6:24:32.2919497 PM","ragel.exe","5712","Load Image","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcp90.dll","SUCCESS","Image Base: 0x78480000, Image Size: 0x8e000"
"6:24:32.2922698 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcr90.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2924170 PM","ragel.exe","5712","QueryStandardInformationFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcr90.dll","SUCCESS","AllocationSize: 655,360, EndOfFile: 653,136, NumberOfLinks: 1, DeletePending: False, Directory: False"
"6:24:32.2925576 PM","ragel.exe","5712","FileSystemControl","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcr90.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"6:24:32.2927087 PM","ragel.exe","5712","CloseFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcr90.dll","SUCCESS",""
"6:24:32.2929526 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcr90.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2933186 PM","ragel.exe","5712","CloseFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcr90.dll","SUCCESS",""
"6:24:32.2947243 PM","ragel.exe","5712","Load Image","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcr90.dll","SUCCESS","Image Base: 0x78520000, Image Size: 0xa3000"
"6:24:32.2953392 PM","ragel.exe","5712","QueryOpen","D:\Devel\Ragel 6.6\bin\ShimEng.dll","NAME NOT FOUND",""
"6:24:32.2956230 PM","ragel.exe","5712","QueryOpen","C:\WINDOWS\system32\shimeng.dll","SUCCESS","CreationTime: 8/12/2004 9:28:21 AM, LastAccessTime: 3/22/2011 6:24:32 PM, LastWriteTime: 4/13/2008 8:12:05 PM, ChangeTime: 1/27/2010 6:09:10 PM, AllocationSize: 65,536, EndOfFile: 65,024, FileAttributes: N"
"6:24:32.2958943 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\system32\shimeng.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2960396 PM","ragel.exe","5712","QueryStandardInformationFile","C:\WINDOWS\system32\shimeng.dll","SUCCESS","AllocationSize: 65,536, EndOfFile: 65,024, NumberOfLinks: 1, DeletePending: False, Directory: False"
"6:24:32.2961739 PM","ragel.exe","5712","FileSystemControl","C:\WINDOWS\system32\shimeng.dll","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"6:24:32.2964245 PM","ragel.exe","5712","CloseFile","C:\WINDOWS\system32\shimeng.dll","SUCCESS",""
"6:24:32.2966519 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\system32\shimeng.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2969690 PM","ragel.exe","5712","CloseFile","C:\WINDOWS\system32\shimeng.dll","SUCCESS",""
"6:24:32.2983301 PM","ragel.exe","5712","Load Image","C:\WINDOWS\system32\shimeng.dll","SUCCESS","Image Base: 0x5cb70000, Image Size: 0x26000"
"6:24:32.2986983 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2988271 PM","ragel.exe","5712","QueryStandardInformationFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","AllocationSize: 1,208,320, EndOfFile: 1,206,508, NumberOfLinks: 1, DeletePending: False, Directory: False"
"6:24:32.2989469 PM","ragel.exe","5712","FileSystemControl","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"6:24:32.2990858 PM","ragel.exe","5712","CloseFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS",""
"6:24:32.2992903 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.2994470 PM","ragel.exe","5712","QueryStandardInformationFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","AllocationSize: 1,208,320, EndOfFile: 1,206,508, NumberOfLinks: 1, DeletePending: False, Directory: False"
"6:24:32.2995830 PM","ragel.exe","5712","QueryStandardInformationFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","AllocationSize: 1,208,320, EndOfFile: 1,206,508, NumberOfLinks: 1, DeletePending: False, Directory: False"
"6:24:32.2997331 PM","ragel.exe","5712","QueryStandardInformationFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","AllocationSize: 1,208,320, EndOfFile: 1,206,508, NumberOfLinks: 1, DeletePending: False, Directory: False"
"6:24:32.2999722 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\AppPatch\systest.sdb","NAME NOT FOUND","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
"6:24:32.3001655 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\AppPatch\systest.sdb","NAME NOT FOUND","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a"
"6:24:32.3002027 PM","ragel.exe","5712","RegOpenKey","HKLM\System\WPA\TabletPC","NAME NOT FOUND","Desired Access: Query Value, WOW64_64Key"
"6:24:32.3002264 PM","ragel.exe","5712","RegOpenKey","HKLM\SYSTEM\WPA\MediaCenter","SUCCESS","Desired Access: Query Value, WOW64_64Key"
"6:24:32.3002817 PM","ragel.exe","5712","RegQueryValue","HKLM\SYSTEM\WPA\MediaCenter\Installed","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0"
"6:24:32.3003125 PM","ragel.exe","5712","RegCloseKey","HKLM\SYSTEM\WPA\MediaCenter","SUCCESS",""
"6:24:32.3005689 PM","ragel.exe","5712","CloseFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS",""
"6:24:32.3006390 PM","ragel.exe","5712","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\snxhk.dll","NAME NOT FOUND","Desired Access: Read"
"6:24:32.3009511 PM","ragel.exe","5712","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Query Value"
"6:24:32.3009966 PM","ragel.exe","5712","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode","NAME NOT FOUND","Length: 16"
"6:24:32.3010248 PM","ragel.exe","5712","RegCloseKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS",""
"6:24:32.3012064 PM","ragel.exe","5712","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters","SUCCESS","Desired Access: Read"
"6:24:32.3012679 PM","ragel.exe","5712","RegQueryValue","HKLM\System\CurrentControlSet\Services\aswSP\Parameters\BehavShield","SUCCESS","Type: REG_DWORD, Length: 4, Data: 1"
"6:24:32.3012958 PM","ragel.exe","5712","RegCloseKey","HKLM\System\CurrentControlSet\Services\aswSP\Parameters","SUCCESS",""
"6:24:32.3014285 PM","ragel.exe","5712","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSVCR90.dll","NAME NOT FOUND","Desired Access: Read"
"6:24:32.3019339 PM","ragel.exe","5712","QueryOpen","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\msvcr90.dll","SUCCESS","CreationTime: 2/16/2010 1:05:52 AM, LastAccessTime: 3/22/2011 6:24:32 PM, LastWriteTime: 2/16/2010 1:05:52 AM, ChangeTime: 8/15/2010 7:00:39 PM, AllocationSize: 655,360, EndOfFile: 653,136, FileAttributes: A"
"6:24:32.3020222 PM","ragel.exe","5712","CreateFile","C:\","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.3020551 PM","ragel.exe","5712","QueryDirectory","C:\WINDOWS","SUCCESS","Filter: WINDOWS, 1: WINDOWS"
"6:24:32.3021247 PM","ragel.exe","5712","CloseFile","C:\","SUCCESS",""
"6:24:32.3026273 PM","ragel.exe","5712","CreateFile","C:\WINDOWS","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.3026929 PM","ragel.exe","5712","QueryDirectory","C:\WINDOWS\WinSxS","SUCCESS","Filter: WinSxS, 1: WinSxS"
"6:24:32.3028189 PM","ragel.exe","5712","CloseFile","C:\WINDOWS","SUCCESS",""
"6:24:32.3030555 PM","ragel.exe","5712","CreateFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.3031718 PM","ragel.exe","5712","QueryDirectory","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f\MSVCR90.dll","SUCCESS","Filter: MSVCR90.dll, 1: msvcr90.dll"
"6:24:32.3034008 PM","ragel.exe","5712","CloseFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f","SUCCESS",""
"6:24:32.3034503 PM","ragel.exe","5712","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSVCP90.dll","NAME NOT FOUND","Desired Access: Read"
"6:24:32.3036827 PM","ragel.exe","5712","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll","NAME NOT FOUND","Desired Access: Read"
"6:24:32.3037053 PM","ragel.exe","5712","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll","NAME NOT FOUND","Desired Access: Read"
"6:24:32.3037235 PM","ragel.exe","5712","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ShimEng.dll","NAME NOT FOUND","Desired Access: Read"
"6:24:32.3041599 PM","ragel.exe","5712","CreateFile","D:\Devel\vvm\close\test.rl","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.3043230 PM","ragel.exe","5712","QueryStandardInformationFile","D:\Devel\vvm\close\test.rl","SUCCESS","AllocationSize: 80, EndOfFile: 73, NumberOfLinks: 1, DeletePending: False, Directory: False"
"6:24:32.3045960 PM","ragel.exe","5712","FileSystemControl","D:\Devel\vvm\close\test.rl","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"6:24:32.3047580 PM","ragel.exe","5712","QueryBasicInformationFile","D:\Devel\vvm\close\test.rl","SUCCESS","CreationTime: 3/22/2011 11:49:44 AM, LastAccessTime: 3/22/2011 6:22:44 PM, LastWriteTime: 3/22/2011 2:03:56 PM, ChangeTime: 3/22/2011 2:03:56 PM, FileAttributes: A"
"6:24:32.3049248 PM","ragel.exe","5712","ReadFile","D:\Devel\vvm\close\test.rl","SUCCESS","Offset: 0, Length: 73"
"6:24:32.3051276 PM","ragel.exe","5712","CloseFile","D:\Devel\vvm\close\test.rl","SUCCESS",""
"6:24:32.3053779 PM","ragel.exe","5712","CreateFile","D:\Devel\vvm\close\test.rl","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.3056067 PM","ragel.exe","5712","ReadFile","D:\Devel\vvm\close\test.rl","SUCCESS","Offset: 0, Length: 73"
"6:24:32.3059542 PM","ragel.exe","5712","CreateFile","D:\Devel\vvm\close\testinc.rl","NAME NOT FOUND","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
"6:24:32.3061920 PM","ragel.exe","5712","CreateFile","D:\Devel\vvm\close\testinc.rl","NAME NOT FOUND","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a"
"6:24:32.3064945 PM","ragel.exe","5712","CreateFile","D:\Devel\vvm\close\x\testinc.rl","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Alert, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.3066895 PM","ragel.exe","5712","QueryStandardInformationFile","D:\Devel\vvm\close\x\testinc.rl","SUCCESS","AllocationSize: 56, EndOfFile: 52, NumberOfLinks: 1, DeletePending: False, Directory: False"
"6:24:32.3068837 PM","ragel.exe","5712","FileSystemControl","D:\Devel\vvm\close\x\testinc.rl","SUCCESS","Control: FSCTL_READ_FILE_USN_DATA"
"6:24:32.3070683 PM","ragel.exe","5712","QueryBasicInformationFile","D:\Devel\vvm\close\x\testinc.rl","SUCCESS","CreationTime: 3/22/2011 2:06:17 PM, LastAccessTime: 3/22/2011 2:20:03 PM, LastWriteTime: 3/22/2011 2:06:17 PM, ChangeTime: 3/22/2011 2:20:03 PM, FileAttributes: A"
"6:24:32.3072519 PM","ragel.exe","5712","ReadFile","D:\Devel\vvm\close\x\testinc.rl","SUCCESS","Offset: 0, Length: 52"
"6:24:32.3076707 PM","ragel.exe","5712","CloseFile","D:\Devel\vvm\close\x\testinc.rl","SUCCESS",""
"6:24:32.3079330 PM","ragel.exe","5712","CreateFile","D:\Devel\vvm\close\x\testinc.rl","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"6:24:32.3082269 PM","ragel.exe","5712","CloseFile","D:\Devel\vvm\close\x\testinc.rl","SUCCESS",""
"6:24:32.3097120 PM","ragel.exe","5712","ReadFile","D:\Devel\vvm\close\test.rl","END OF FILE","Offset: 73, Length: 4,096"
"6:24:32.3099385 PM","ragel.exe","5712","Thread Exit","","SUCCESS","Thread ID: 5076, User Time: 0.0000000, Kernel Time: 0.0156250"
"6:24:32.3109267 PM","ragel.exe","5712","CloseFile","D:\Devel\vvm\close\test.rl","SUCCESS",""
"6:24:32.3110772 PM","ragel.exe","5712","CloseFile","C:\WINDOWS\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4974_x-ww_d889290f","SUCCESS",""

