Filemon is showing alot of this happening while the demo is running,
10:16:05 explorer.exe:1376 QUERY INFORMATION C:\WINDOWS\System32\shell32.dll SUCCESS Attributes: A
10:16:05 explorer.exe:1376 QUERY INFORMATION C:\WINDOWS\System32\shell32.dll SUCCESS Attributes: A
10:16:05 explorer.exe:1376 OPEN C:\WINDOWS\System32\shell32.dll SUCCESS Options: Open Access: All
10:16:05 explorer.exe:1376 QUERY INFORMATION C:\WINDOWS\System32\shell32.dll SUCCESS Attributes: A
10:16:05 explorer.exe:1376 SET INFORMATION C:\WINDOWS\System32\shell32.dll SUCCESS FileBasicInformation
10:16:05 explorer.exe:1376 READ C:\WINDOWS\System32\shell32.dll SUCCESS Offset: 0 Length: 12
10:16:05 explorer.exe:1376 QUERY INFORMATION C:\WINDOWS\System32\shell32.dll SUCCESS Length: 8450560
10:16:05 explorer.exe:1376 QUERY INFORMATION C:\WINDOWS\System32\shell32.dll SUCCESS Length: 8450560
10:16:05 explorer.exe:1376 CLOSE C:\WINDOWS\System32\shell32.dll SUCCESS
Trying new demo now...
10:16:05 explorer.exe:1376 QUERY INFORMATION C:\WINDOWS\System32\shell32.dll SUCCESS Attributes: A
10:16:05 explorer.exe:1376 QUERY INFORMATION C:\WINDOWS\System32\shell32.dll SUCCESS Attributes: A
10:16:05 explorer.exe:1376 OPEN C:\WINDOWS\System32\shell32.dll SUCCESS Options: Open Access: All
10:16:05 explorer.exe:1376 QUERY INFORMATION C:\WINDOWS\System32\shell32.dll SUCCESS Attributes: A
10:16:05 explorer.exe:1376 SET INFORMATION C:\WINDOWS\System32\shell32.dll SUCCESS FileBasicInformation
10:16:05 explorer.exe:1376 READ C:\WINDOWS\System32\shell32.dll SUCCESS Offset: 0 Length: 12
10:16:05 explorer.exe:1376 QUERY INFORMATION C:\WINDOWS\System32\shell32.dll SUCCESS Length: 8450560
10:16:05 explorer.exe:1376 QUERY INFORMATION C:\WINDOWS\System32\shell32.dll SUCCESS Length: 8450560
10:16:05 explorer.exe:1376 CLOSE C:\WINDOWS\System32\shell32.dll SUCCESS
Trying new demo now...