Time of Day Process Name PID Operation Path Result Detail 19:45:27,3016571 WINWORD.EXE 3448 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 19:45:27,3017105 WINWORD.EXE 3448 QueryBasicInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS CreationTime: 2011-05-29 17:01:41, LastAccessTime: 2011-05-29 17:01:41, LastWriteTime: 2011-05-29 17:01:42, ChangeTime: 2011-05-29 17:01:43, FileAttributes: RANCI 19:45:27,3017293 WINWORD.EXE 3448 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:45:27,3018436 WINWORD.EXE 3448 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:45:27,3035555 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 4 096, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3120730 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 4 825 088, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3160705 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 4 325 376, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3196602 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 160 384, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3262247 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 5 890 048, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3297766 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 291 456, Length: 57 344, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3354805 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 4 390 912, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3361621 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 225 920, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3373078 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 029 312, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3389709 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 094 848, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3434629 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 5 767 168, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3443868 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 2 097 152, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3597926 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 1 507 328, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3654461 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 5 439 488, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3700047 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 5 505 024, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3708755 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 1 638 400, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3716581 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 1 769 472, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3750367 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 3 801 088, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3831421 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 5 988 352, Length: 40 960, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3836974 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 3 670 016, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3848546 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 3 866 624, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3854476 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 262 144, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3889278 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 4 063 232, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,3930547 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 5 046 272, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,4007298 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 1 376 256, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,4058942 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 3 997 696, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,4064723 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 1 048 576, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,4072694 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 5 701 632, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,4079299 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 5 570 560, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,4085967 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 4 923 392, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,4091325 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 4 988 928, Length: 57 344, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,4108280 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 3 932 160, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,4115776 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 1 703 936, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,4213992 avp.exe 2372 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 1 441 792, Length: 65 536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O, Priority: Normal 19:45:27,4803003 WINWORD.EXE 3448 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection: 19:45:27,4826875 WINWORD.EXE 3448 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther 19:45:27,4830440 WINWORD.EXE 3448 Load Image C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Image Base: 0x6b390000, Image Size: 0x62e000 19:45:27,4830895 WINWORD.EXE 3448 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:45:27,4834815 WINWORD.EXE 3448 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 19:45:27,4836272 WINWORD.EXE 3448 QueryBasicInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS CreationTime: 2011-05-29 17:01:41, LastAccessTime: 2011-05-29 17:01:41, LastWriteTime: 2011-05-29 17:01:42, ChangeTime: 2011-05-29 17:01:43, FileAttributes: RANCI 19:45:27,4836575 WINWORD.EXE 3448 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:45:27,4838069 WINWORD.EXE 3448 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:45:27,4838624 WINWORD.EXE 3448 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther 19:45:27,4840675 WINWORD.EXE 3448 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection: 19:45:27,4856294 WINWORD.EXE 3448 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther 19:45:27,4856647 WINWORD.EXE 3448 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:45:27,4859767 WINWORD.EXE 3448 Load Image C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Image Base: 0x658f0000, Image Size: 0x62e000 19:45:27,4862459 WINWORD.EXE 3448 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:45:27,4862989 WINWORD.EXE 3448 QueryBasicInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS CreationTime: 2011-05-29 17:01:41, LastAccessTime: 2011-05-29 17:01:41, LastWriteTime: 2011-05-29 17:01:42, ChangeTime: 2011-05-29 17:01:43, FileAttributes: RANCI 19:45:27,4864247 WINWORD.EXE 3448 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:45:28,6219533 WINWORD.EXE 3448 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:45:28,6220438 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 0, Length: 64, Priority: Normal 19:45:28,6221141 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 280, Length: 4 19:45:28,6221598 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 284, Length: 20 19:45:28,6222120 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 528, Length: 40 19:45:28,6222588 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 568, Length: 40 19:45:28,6222934 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 608, Length: 40 19:45:28,6223288 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 648, Length: 40 19:45:28,6223751 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 688, Length: 40 19:45:28,6224103 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 728, Length: 40 19:45:28,6224676 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 912, Length: 16 19:45:28,6225158 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 928, Length: 8 19:45:28,6225495 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 728, Length: 2 19:45:28,6225878 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 936, Length: 8 19:45:28,6226201 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 746, Length: 2 19:45:28,6226702 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 748, Length: 14 19:45:28,6227077 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 056, Length: 16 19:45:28,6227446 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 072, Length: 8 19:45:28,6227874 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 536, Length: 16 19:45:28,6228163 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 552, Length: 8 19:45:28,6228466 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 057 296, Length: 16 19:45:28,6228814 WINWORD.EXE 3448 QueryStandardInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS AllocationSize: 6 381 568, EndOfFile: 6 378 144, NumberOfLinks: 1, DeletePending: False, Directory: False 19:45:28,6229239 WINWORD.EXE 3448 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection: 19:45:28,6229547 WINWORD.EXE 3448 QueryStandardInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS AllocationSize: 6 381 568, EndOfFile: 6 378 144, NumberOfLinks: 1, DeletePending: False, Directory: False 19:45:28,6229927 WINWORD.EXE 3448 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther 19:45:28,6359231 WINWORD.EXE 3448 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:45:28,6361065 WINWORD.EXE 3448 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:45:28,6361670 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 0, Length: 64, Priority: Normal 19:45:28,6361922 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 280, Length: 4 19:45:28,6362260 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 284, Length: 20 19:45:28,6362573 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 528, Length: 40 19:45:28,6362912 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 568, Length: 40 19:45:28,6363241 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 608, Length: 40 19:45:28,6363607 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 648, Length: 40 19:45:28,6363967 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 688, Length: 40 19:45:28,6364283 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 728, Length: 40 19:45:28,6364575 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 912, Length: 16 19:45:28,6364841 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 928, Length: 8 19:45:28,6365124 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 728, Length: 2 19:45:28,6365386 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 936, Length: 8 19:45:28,6365650 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 746, Length: 2 19:45:28,6365895 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 748, Length: 14 19:45:28,6366191 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 056, Length: 16 19:45:28,6366458 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 072, Length: 8 19:45:28,6366742 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 536, Length: 16 19:45:28,6367008 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 552, Length: 8 19:45:28,6367329 WINWORD.EXE 3448 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 057 296, Length: 16 19:45:28,6367642 WINWORD.EXE 3448 QueryStandardInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS AllocationSize: 6 381 568, EndOfFile: 6 378 144, NumberOfLinks: 1, DeletePending: False, Directory: False 19:45:28,6367851 WINWORD.EXE 3448 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection: 19:45:28,6368028 WINWORD.EXE 3448 QueryStandardInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS AllocationSize: 6 381 568, EndOfFile: 6 378 144, NumberOfLinks: 1, DeletePending: False, Directory: False 19:45:28,6368346 WINWORD.EXE 3448 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther 19:45:32,8775438 WINWORD.EXE 3448 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:25,4706183 WINWORD.EXE 1320 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:25,4706815 WINWORD.EXE 1320 QueryBasicInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS CreationTime: 2011-05-29 17:01:41, LastAccessTime: 2011-05-29 17:01:41, LastWriteTime: 2011-05-29 17:01:42, ChangeTime: 2011-05-29 17:01:43, FileAttributes: RANCI 19:48:25,4707011 WINWORD.EXE 1320 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:25,4708426 WINWORD.EXE 1320 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:25,4708970 WINWORD.EXE 1320 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection: 19:48:25,4725769 WINWORD.EXE 1320 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther 19:48:25,4729409 WINWORD.EXE 1320 Load Image C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Image Base: 0x68d50000, Image Size: 0x62e000 19:48:25,4729923 WINWORD.EXE 1320 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:25,4732445 WINWORD.EXE 1320 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:25,4732974 WINWORD.EXE 1320 QueryBasicInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS CreationTime: 2011-05-29 17:01:41, LastAccessTime: 2011-05-29 17:01:41, LastWriteTime: 2011-05-29 17:01:42, ChangeTime: 2011-05-29 17:01:43, FileAttributes: RANCI 19:48:25,4733161 WINWORD.EXE 1320 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:25,4734322 WINWORD.EXE 1320 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:25,4734894 WINWORD.EXE 1320 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection: 19:48:25,4751926 WINWORD.EXE 1320 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther 19:48:25,4752420 WINWORD.EXE 1320 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:25,4756182 WINWORD.EXE 1320 Load Image C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Image Base: 0x658f0000, Image Size: 0x62e000 19:48:25,4759399 WINWORD.EXE 1320 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:25,4760112 WINWORD.EXE 1320 QueryBasicInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS CreationTime: 2011-05-29 17:01:41, LastAccessTime: 2011-05-29 17:01:41, LastWriteTime: 2011-05-29 17:01:42, ChangeTime: 2011-05-29 17:01:43, FileAttributes: RANCI 19:48:25,4761309 WINWORD.EXE 1320 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:27,0659140 WINWORD.EXE 1320 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:27,0659674 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 0, Length: 64, Priority: Normal 19:48:27,0659998 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 280, Length: 4 19:48:27,0660285 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 284, Length: 20 19:48:27,0660550 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 528, Length: 40 19:48:27,0660830 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 568, Length: 40 19:48:27,0661089 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 608, Length: 40 19:48:27,0661343 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 648, Length: 40 19:48:27,0661594 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 688, Length: 40 19:48:27,0661847 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 728, Length: 40 19:48:27,0662119 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 912, Length: 16 19:48:27,0662398 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 928, Length: 8 19:48:27,0662669 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 728, Length: 2 19:48:27,0662937 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 936, Length: 8 19:48:27,0663206 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 746, Length: 2 19:48:27,0663450 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 748, Length: 14 19:48:27,0663724 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 056, Length: 16 19:48:27,0663986 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 072, Length: 8 19:48:27,0664294 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 536, Length: 16 19:48:27,0664565 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 552, Length: 8 19:48:27,0664839 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 057 296, Length: 16 19:48:27,0665123 WINWORD.EXE 1320 QueryStandardInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS AllocationSize: 6 381 568, EndOfFile: 6 378 144, NumberOfLinks: 1, DeletePending: False, Directory: False 19:48:27,0665355 WINWORD.EXE 1320 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection: 19:48:27,0665501 WINWORD.EXE 1320 QueryStandardInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS AllocationSize: 6 381 568, EndOfFile: 6 378 144, NumberOfLinks: 1, DeletePending: False, Directory: False 19:48:27,0665790 WINWORD.EXE 1320 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther 19:48:27,0677445 WINWORD.EXE 1320 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:27,0678593 WINWORD.EXE 1320 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:27,0679074 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 0, Length: 64, Priority: Normal 19:48:27,0679282 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 280, Length: 4 19:48:27,0679556 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 284, Length: 20 19:48:27,0679821 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 528, Length: 40 19:48:27,0680095 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 568, Length: 40 19:48:27,0680352 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 608, Length: 40 19:48:27,0680611 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 648, Length: 40 19:48:27,0680866 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 688, Length: 40 19:48:27,0681122 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 728, Length: 40 19:48:27,0681398 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 912, Length: 16 19:48:27,0681650 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 928, Length: 8 19:48:27,0681919 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 728, Length: 2 19:48:27,0682175 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 936, Length: 8 19:48:27,0682442 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 746, Length: 2 19:48:27,0682691 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 748, Length: 14 19:48:27,0682972 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 056, Length: 16 19:48:27,0683236 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 072, Length: 8 19:48:27,0683508 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 536, Length: 16 19:48:27,0683756 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 552, Length: 8 19:48:27,0684024 WINWORD.EXE 1320 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 057 296, Length: 16 19:48:27,0684287 WINWORD.EXE 1320 QueryStandardInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS AllocationSize: 6 381 568, EndOfFile: 6 378 144, NumberOfLinks: 1, DeletePending: False, Directory: False 19:48:27,0684463 WINWORD.EXE 1320 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection: 19:48:27,0684595 WINWORD.EXE 1320 QueryStandardInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS AllocationSize: 6 381 568, EndOfFile: 6 378 144, NumberOfLinks: 1, DeletePending: False, Directory: False 19:48:27,0684871 WINWORD.EXE 1320 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther 19:48:29,8551683 WINWORD.EXE 1320 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:32,1080263 WINWORD.EXE 2600 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:32,1080780 WINWORD.EXE 2600 QueryBasicInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS CreationTime: 2011-05-29 17:01:41, LastAccessTime: 2011-05-29 17:01:41, LastWriteTime: 2011-05-29 17:01:42, ChangeTime: 2011-05-29 17:01:43, FileAttributes: RANCI 19:48:32,1080967 WINWORD.EXE 2600 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:32,1082266 WINWORD.EXE 2600 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:32,1082844 WINWORD.EXE 2600 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection: 19:48:32,1099012 WINWORD.EXE 2600 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther 19:48:32,1101814 WINWORD.EXE 2600 Load Image C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Image Base: 0x6e5d0000, Image Size: 0x62e000 19:48:32,1102209 WINWORD.EXE 2600 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:32,1104430 WINWORD.EXE 2600 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:32,1104896 WINWORD.EXE 2600 QueryBasicInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS CreationTime: 2011-05-29 17:01:41, LastAccessTime: 2011-05-29 17:01:41, LastWriteTime: 2011-05-29 17:01:42, ChangeTime: 2011-05-29 17:01:43, FileAttributes: RANCI 19:48:32,1105075 WINWORD.EXE 2600 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:32,1106155 WINWORD.EXE 2600 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Read Data/List Directory, Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:32,1106611 WINWORD.EXE 2600 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection: 19:48:32,1120637 WINWORD.EXE 2600 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther 19:48:32,1120975 WINWORD.EXE 2600 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:32,1123487 WINWORD.EXE 2600 Load Image C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Image Base: 0x68000000, Image Size: 0x62e000 19:48:32,1126629 WINWORD.EXE 2600 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:32,1127281 WINWORD.EXE 2600 QueryBasicInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS CreationTime: 2011-05-29 17:01:41, LastAccessTime: 2011-05-29 17:01:41, LastWriteTime: 2011-05-29 17:01:42, ChangeTime: 2011-05-29 17:01:43, FileAttributes: RANCI 19:48:32,1128494 WINWORD.EXE 2600 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:32,3760731 WINWORD.EXE 2600 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:32,3761261 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 0, Length: 64, Priority: Normal 19:48:32,3761576 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 280, Length: 4 19:48:32,3761859 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 284, Length: 20 19:48:32,3762126 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 528, Length: 40 19:48:32,3762414 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 568, Length: 40 19:48:32,3762675 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 608, Length: 40 19:48:32,3762930 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 648, Length: 40 19:48:32,3763184 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 688, Length: 40 19:48:32,3763440 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 728, Length: 40 19:48:32,3763713 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 912, Length: 16 19:48:32,3763987 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 928, Length: 8 19:48:32,3764259 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 728, Length: 2 19:48:32,3764526 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 936, Length: 8 19:48:32,3764794 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 746, Length: 2 19:48:32,3765040 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 748, Length: 14 19:48:32,3765316 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 056, Length: 16 19:48:32,3765580 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 072, Length: 8 19:48:32,3765850 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 536, Length: 16 19:48:32,3766098 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 552, Length: 8 19:48:32,3766355 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 057 296, Length: 16 19:48:32,3766622 WINWORD.EXE 2600 QueryStandardInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS AllocationSize: 6 381 568, EndOfFile: 6 378 144, NumberOfLinks: 1, DeletePending: False, Directory: False 19:48:32,3766819 WINWORD.EXE 2600 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection: 19:48:32,3766958 WINWORD.EXE 2600 QueryStandardInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS AllocationSize: 6 381 568, EndOfFile: 6 378 144, NumberOfLinks: 1, DeletePending: False, Directory: False 19:48:32,3767241 WINWORD.EXE 2600 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther 19:48:32,3778305 WINWORD.EXE 2600 CloseFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS 19:48:32,3779409 WINWORD.EXE 2600 CreateFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened 19:48:32,3779876 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 0, Length: 64, Priority: Normal 19:48:32,3780081 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 280, Length: 4 19:48:32,3780364 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 284, Length: 20 19:48:32,3780627 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 528, Length: 40 19:48:32,3780892 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 568, Length: 40 19:48:32,3781147 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 608, Length: 40 19:48:32,3781399 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 648, Length: 40 19:48:32,3781649 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 688, Length: 40 19:48:32,3781898 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 728, Length: 40 19:48:32,3782177 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 912, Length: 16 19:48:32,3782429 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 928, Length: 8 19:48:32,3782691 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 728, Length: 2 19:48:32,3782944 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 054 936, Length: 8 19:48:32,3783208 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 746, Length: 2 19:48:32,3783475 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 059 748, Length: 14 19:48:32,3783755 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 056, Length: 16 19:48:32,3784017 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 072, Length: 8 19:48:32,3784284 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 536, Length: 16 19:48:32,3784528 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 055 552, Length: 8 19:48:32,3784781 WINWORD.EXE 2600 ReadFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS Offset: 6 057 296, Length: 16 19:48:32,3785042 WINWORD.EXE 2600 QueryStandardInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS AllocationSize: 6 381 568, EndOfFile: 6 378 144, NumberOfLinks: 1, DeletePending: False, Directory: False 19:48:32,3785218 WINWORD.EXE 2600 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx FILE LOCKED WITH ONLY READERS SyncType: SyncTypeCreateSection, PageProtection: 19:48:32,3785348 WINWORD.EXE 2600 QueryStandardInformationFile C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS AllocationSize: 6 381 568, EndOfFile: 6 378 144, NumberOfLinks: 1, DeletePending: False, Directory: False 19:48:32,3785622 WINWORD.EXE 2600 CreateFileMapping C:\Windows\SysWOW64\Macromed\Flash\Flash10q.ocx SUCCESS SyncType: SyncTypeOther